References https://github.com/advisories/GHSA-399j-vxmf-hjvr https://jfrog.com/blog/cve-2025-11953-critical-react-native-community-cli-vulnerability/ https://www.ithome.com.tw/news/172082 https://thehackernews.com/2025/11/critical-react-native-cli-flaw-exposed.html https://zeropath.com/blog/cve-2025-11953-react-native-metro-cli-os-command-injection https://nvd.nist.gov/vuln/detail/CVE-2025-11953 https://security.snyk.io/vuln/SNYK-JS-REACTNATIVECOMMUNITYCLISERVERAPI-13836141 https://www.ithome.com.tw/news/173773 https://cybersecuritynews.com/react-native-command-injection-flaw/ https://securityaffairs.com/187587/hacking/hackers-abused-react-native-cli-flaw-to-deploy-rust-malware-before-public-disclosure.html
Related VulnerabilitiesPoCCVE-2025-11953: React Native Community CLI - Unauthenticated OS Command InjectionPoCReact Native CLI /open-url 命令执行漏洞(CVE-2025-11953)PoCCVE-2025-55184: React Server Components - Denial of ServicePoCCVE-2025-55182: React Server Components - Remote Code ExecutionPoCReact Server Components 远程代码执行漏洞(CVE-2025-55182)Facebook Below 权限管理不当漏洞PoCCVE-2024-0801: Arcserve Unified Data Protection - Unauthenticated DoS in ASNative.dllPoCgcloud-gke-vpc-native-disabled: GKE Clusters Without VPC-Native Traffic RoutingPoCfacebook-graph-csp-bypass: Content-Security-Policy Bypass - Facebook GraphPoCfacebook-secret-key: Facebook Secret Key - DetectPoCreactapp-env-js: React App Environment JsPoCnativechurch-wp-theme-lfd: WordPress NativeChurch Theme - Local File Inclusion