CVE-2025-11953

The Metro development server launched by the React Native Community CLI binds to external network interfaces by default and exposes an endpoint vulnerable to operating system command injection (CWE-78). An unauthenticated attacker with network reachability to the dev server can trigger the flaw by sending a crafted POST request to that endpoint. Successful exploitation lets the attacker run arbitrary executables on the host, and on Windows the attacker can execute arbitrary shell commands with fully controlled arguments, effectively achieving full remote code execution on the developer machine. Anyone running the Metro dev server via the community CLI where its port is reachable from an untrusted network, such as shared office, campus, or cloud development environments, is affected. Exploitation is confirmed in the wild: the flaw was added to CISA's KEV catalog on 2026-02-05, carries a 94% EPSS score, and attackers reportedly used it to deploy Rust malware before public disclosure.

What to do: Upgrade the React Native Community CLI to the latest patched release per the vendor advisory (fixed versions are not specified in the source data). As interim mitigation, run the Metro dev server bound to localhost only or firewall its port from untrusted networks, and stop leaving dev servers running on externally reachable interfaces. Because exploitation predates public disclosure, review Windows developer machines for signs of compromise, including unexpected executables or Rust-based malware, per the JFrog and VulnCheck analyses.