CVE-2025-11953

CriticalCVSS 9.8/10Known exploited (CISA KEV)Last modified Nov 5, 2026

Description

The Metro Development Server, which is opened by the React Native Community CLI, binds to external interfaces by default. The server exposes an endpoint that is vulnerable to OS command injection. This allows unauthenticated network attackers to send a POST request to the server and run arbitrary executables. On Windows, the attackers can also execute arbitrary shell commands with fully controlled arguments.

Metrics

CVSS 3.1 9.8/10CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Weakness enumeration

CWE-78

Affected software

Vendor	Product	Versions
—	—	>= 4.8.0, < 20.0.0

References

https://github.com/react-native-community/cli/commit/15089907d1f1301b22c72d7f68846a2ef20df547Patch
https://jfrog.com/blog/cve-2025-11953-critical-react-native-community-cli-vulnerabilityExploit, Mitigation, Third Party Advisory
https://x.com/SzymonRybczak/status/1986199665000566848Third Party Advisory
https://x.com/thymikee/status/1986770875954475375Third Party Advisory
https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2025-11953US Government Resource
https://www.vulncheck.com/blog/metro4shell_eitwExploit, Third Party Advisory

Timeline

Published: Nov 3, 2025
Last modified: Nov 5, 2026
Added to CISA KEV: Feb 5, 2026
NVD status: Analyzed

Related CVEs from 2025

CVE-2025-119548.0Cross-Site request forgery (CSRF) vulnerability in Sitemio Information Technologies Trade Ltd. Co. WISECP allows Cross Site Request Forgery.CVE-2025-119558.2Incorrect validation of OCSP certificates vulnerability in TheGreenBow VPN, versions 7.5 and 7.6. During the IKEv2 authentication step, the CVE-2025-119568.9Improper Neutralization of Input During Web Page Generation (XSS or 'Cross-site Scripting') vulnerability in Proliz Software Ltd. Co. OBS (S CVE-2025-119578.4Improper authorization in the temporary access workflow of Devolutions Server 2025.2.12.0 and earlier allows an authenticated basic user to CVE-2025-119584.1An improper input validation in the Security Dashboard ignored-tasks API of Devolutions Server 2025.2.15.0 and earlier allows an authenticat CVE-2025-119598.1Files or Directories Accessible to External Parties, Exposure of Private Personal Information to an Unauthorized Actor vulnerability in Prem CVE-2025-11965.4A vulnerability, which was classified as problematic, was found in code-projects Real Estate Property Management System 1.0. Affected is an CVE-2025-119606.1Improper Neutralization of Input During Web Page Generation (XSS or 'Cross-site Scripting') vulnerability in Aryom Software High Technology CVE-2025-119611.9pcap_ether_aton() is an auxiliary function in libpcap, it takes a string argument and returns a fixed-size allocated buffer. The string arg CVE-2025-119627.3Improper Neutralization of Input During Web Page Generation (XSS or 'Cross-site Scripting') vulnerability in DivvyDrive Information Technolo CVE-2025-119635.4Improper Neutralization of Input During Web Page Generation (XSS or 'Cross-site Scripting') vulnerability in Saysis Computer Systems Trade L CVE-2025-119641.9On Windows only, if libpcap needs to convert a Windows error message to UTF-8 and the message includes characters that UTF-8 represents usin