Threat intelligence / Vulnerability
CVE-2025-11953
React Native Community CLI contains an OS command injection vulnerability which could allow unauthenticated network attackers to send POST requests to the Metro Development Server and run arbitrary executables via a vulnerable endpoint exposed by the server. On Windows, attackers can also execute arbitrary shell commands with fully controlled arguments.
Vulnerability
TypeVulnerability
External ID—
First seen2026-02-05
Last seen2026-02-05
Confidence
—
React Native Community CLI contains an OS command injection vulnerability which could allow unauthenticated network attackers to send POST requests to the Metro Development Server and run arbitrary executables via a vulnerable endpoint exposed by the server. On Windows, attackers can also execute arbitrary shell commands with fully controlled arguments.
Labels
CISA KEV context
Vendor / productReact Native Community CLI
Added2026-02-05
Due date2026-02-26
6 recorded
Relationships
2 external