Hackers Exploit Metro4Shell RCE Flaw in React Native CLI npm Package
Vulnerabilities mentionedAll →
| CVE | Vulnerability | CVSS | EPSS | Flags | Affected | Exposure | Published |
|---|---|---|---|---|---|---|---|
| CVE-2025-11953 | Unauthenticated OS Command Injection in React Native Community CLI (Metro4Shell) The Metro development server launched by the React Native Community CLI binds to external network interfaces by default and exposes an endpoint vulnerable to operating system command injection (CWE-78). An unauthenticated attacker with network reachability to the dev server can trigger the flaw by sending a crafted POST request to that endpoint. Successful exploitation lets the attacker run arbitrary executables on the host, and on Windows the attacker can execute arbitrary shell commands with fully controlled arguments, effectively achieving full remote code execution on the developer machine. Anyone running the Metro dev server via the community CLI where its port is reachable from an untrusted network, such as shared office, campus, or cloud development environments, is affected. Exploitation is confirmed in the wild: the flaw was added to CISA's KEV catalog on 2026-02-05, carries a 94% EPSS score, and attackers reportedly used it to deploy Rust malware before public disclosure. Do: Upgrade the React Native Community CLI to the latest patched release per the vendor advisory (fixed versions are not specified in the source data). As interim mitigation, run the Metro dev server bound to localhost only or firewall its port from untrusted networks, and stop leaving dev servers running on externally reachable interfaces. Because exploitation predates public disclosure, review Windows developer machines for signs of compromise, including unexpected executables or Rust-based malware, per the JFrog and VulnCheck analyses. | 9.8 | 94% | KEV PoC ×2 |
| massmillions of developer environments potentially exposed (headline reporting puts exposed developers in the millions); the count of actually internet-exposed dev… |
Full article354 words · extracted from thehackernews.com · click to collapse
Ravie LakshmananFeb 03, 2026Open Source / Vulnerability
Threat actors have been observed exploiting a critical security flaw impacting the Metro Development Server in the popular "@react-native-community/cli" npm package.
Cybersecurity company VulnCheck said it first observed exploitation of CVE-2025-11953 (aka Metro4Shell) on December 21, 2025. With a CVSS score of 9.8, the vulnerability allows remote unauthenticated attackers to execute arbitrary operating system commands on the underlying host. Details of the flaw were first documented by JFrog in November 2025.
Despite more than a month after initial exploitation in the wild, the "activity has yet to see broad public acknowledgment," it added.
In the attack detected against its honeypot network, the threat actors have weaponized the flaw to deliver a Base64-encoded PowerShell script that, once parsed, is configured to perform a series of actions, including Microsoft Defender Antivirus exclusions for the current working directory and the temporary folder ("C:\Users\<Username>\AppData\Local\Temp").
The PowerShell script also establishes a raw TCP connection to an attacker-controlled host and port ("8.218.43[.]248:60124") and sends a request to retrieve data, write it to a file in the temporary directory, and execute it. The downloaded binary is based in Rust, and features anti-analysis checks to hinder static inspection.
The attacks have been found to originate from the following IP addresses -
- 5.109.182[.]231
- 223.6.249[.]141
- 134.209.69[.]155
Describing the activity as neither experimental nor exploratory, VulnCheck said the delivered payloads were "consistent across multiple weeks of exploitation, indicating operational use rather than vulnerability probing or proof-of-concept testing."
"CVE-2025-11953 is not remarkable because it exists. It is remarkable because it reinforces a pattern defenders continue to relearn. Development infrastructure becomes production infrastructure the moment it is reachable, regardless of intent."
Update
The U.S. Cybersecurity and Infrastructure Security Agency (CISA), on February 5, 2026, added CVE-2025-11953 to its Known Exploited Vulnerabilities (KEV) catalog, requiring Federal Civilian Executive Branch (FCEB) agencies to apply the fixes by February 26, 2026.
(The story was updated after publication on February 6, 2026, to include details of CISA's alert.)
Found this article interesting? Follow us on Google News, Twitter and LinkedIn to read more exclusive content we post.
Text extracted automatically; images, tables and formatting may be missing. Original: https://thehackernews.com/2026/02/hackers-exploit-metro4shell-rce-flaw-in.html