Hackers abused React Native CLI flaw to deploy Rust malware before public disclosure
Vulnerabilities mentioned
All| CVE | Vulnerability | CVSS | EPSS | Signals | Published |
|---|---|---|---|---|---|
| CVE-2025-11953 | Unauthenticated OS Command Injection in React Native Community CLI (Metro4Shell) | 9.8 | 94% | KEVPoC ×2 | KEV |
Indicators of compromise
auto-extracted · verify before use · export allAll| Type | Indicator | Context |
|---|---|---|
| ipv4 | 134.209.69.155 | 2.231 Exploitation source 223.6.249.141 Exploitation source 134.209.69.155 Exploitation source 8.218.43.248 Payload host (Windows) 47. |
| ipv4 | 223.6.249.141 | Indicator Observed Role 65.109.182.231 Exploitation source 223.6.249.141 Exploitation source 134.209.69.155 Exploitation source 8.21 |
| ipv4 | 47.86.33.195 | 155 Exploitation source 8.218.43.248 Payload host (Windows) 47.86.33.195 Payload host (Windows and Linux) “CVE-2025-11953 is not rem |
| ipv4 | 65.109.182.231 | astructure involved in the attacks: Indicator Observed Role 65.109.182.231 Exploitation source 223.6.249.141 Exploitation source 134.2 |
| ipv4 | 8.218.43.248 | .141 Exploitation source 134.209.69.155 Exploitation source 8.218.43.248 Payload host (Windows) 47.86.33.195 Payload host (Windows a |
From the original article
2 min read at securityaffairs.com
Hackers exploit a critical React Native CLI flaw (CVE-2025-11953) to run remote commands and drop stealthy Rust malware, weeks before public disclosure. Attackers are actively exploiting a critical flaw in the React Native CLI Metro server, tracked as CVE-2025-11953 . The React Native CLI’s Metro dev server binds to external interfaces by default and exposes a command injection flaw.
By @securityaffairs · securityaffairs.com
A short excerpt; the article and its images belong to the publisher. Summary, key facts and assessment above are AI-written from the article and can be wrong.