CVE-2025-11953 React Native Community CLI OS Command Injection
Unauthenticated attackers can execute arbitrary commands via the Metro Development Server exposed by React Native Community CLI.
- Exploited in the wild
- Since 5 Feb 2026
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- Available
What is CVE-2025-11953?
CVE-2025-11953 is a critical command injection vulnerability in react-native-community:react_native_community_cli, published on 3 Nov 2025. An attacker can exploit it over the internet without logging in, with no action from the victim.
Official description
The Metro Development Server, which is opened by the React Native Community CLI, binds to external interfaces by default. The server exposes an endpoint that is vulnerable to OS command injection. This allows unauthenticated network attackers to send a POST request to the server and run arbitrary executables. On Windows, the attackers can also execute arbitrary shell commands with fully controlled arguments.
Weakness: CWE-78
Which versions are affected by CVE-2025-11953?
12 open source packages ship an affected version, including @react-native-community/cli and @react-native-community/cli-server-api. It affects 1 product.
| Package | Affected | Fixed in |
|---|---|---|
@react-native-community/cli npm | From 18.0.0 | 18.0.1 |
@react-native-community/cli npm | From 18.0.0 | 18.0.1 |
@react-native-community/cli npm | From 19.0.0-alpha.0 | 19.1.2 |
@react-native-community/cli npm | From 19.0.0-alpha.0 | 19.1.2 |
@react-native-community/cli npm | From 20.0.0-alpha.0 | 20.0.0 |
@react-native-community/cli npm | From 20.0.0-alpha.0 | 20.0.0 |
6 more packages
@react-native-community/cli-server-api npm | From 18.0.0 | 18.0.1 |
@react-native-community/cli-server-api npm | From 18.0.0 | 18.0.1 |
@react-native-community/cli-server-api npm | From 19.0.0-alpha.0 | 19.1.2 |
@react-native-community/cli-server-api npm | From 19.0.0-alpha.0 | 19.1.2 |
@react-native-community/cli-server-api npm | From 20.0.0-alpha.0 | 20.0.0 |
@react-native-community/cli-server-api npm | From 20.0.0-alpha.0 | 20.0.0 |
Products include React-Native-Community React Native Community Cli.
How do I fix CVE-2025-11953?
Upgrade @react-native-community/cli to a fixed version for your release line: 18.0.1, 19.1.2 or 20.0.0. US federal agencies must fix it by 26 Feb 2026.
Upgrade, and pass arguments to programs as a list instead of through a shell. More about Command injection.
Is CVE-2025-11953 being exploited?
Yes. Attackers have exploited CVE-2025-11953 in the wild since at least 5 Feb 2026.
Public exploit code: 1 Nuclei template and 3 proofs of concept on GitHub.
Sources
Also known as CLSA-2026-1789566692, CLSA-2026-1789568169, CLSA-2026-1790866461, CLSA-2026-1790869390, CLSA-2026-1790870094, CLSA-2026-1790871357 and 41 more.