GHSA-399j-vxmf-hjvr · Severity: critical · Ecosystem: npm — @react-native-community/cli has arbitrary OS command injection
The Metro Development Server, which is opened by the React Native Community CLI, binds to external interfaces by default. The server exposes an endpoint that is vulnerable to OS command injection. This allows unauthenticated network attackers to send a POST request to the server and run arbitrary executables. On Windows, the attackers can also execute arbitrary shell commands with fully controlled arguments.
Conclusion & alert: CVE-2025-11953 is rated Critical Active Threat (95.4/100): CVSS Critical severity, with high exploitation likelihood (EPSS 20.12%, 96th percentile). Core evidence: CISA KEV confirms active exploitation (added 2026-02-05) affecting React Native Community / CLI. a weakness (CWE-78) Unauthenticated remote administrative access may be possible. Mandatory action: The CISA remediation deadline has passed—treat as an emergency patch priority.
Risk is dynamic; we continuously reassess and refresh what is shown on this page as upstream context changes.
: React Native Community CLI OS Command Injection Vulnerability · CISA KEV detail
: 2026-02-05
: 2026-02-26
: Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable.
| EDB-ID | Source | Kind | Published | Link |
|---|---|---|---|---|
| — | nvd_ref | exploit_tag | Exploit-DB ↗ | |
| — | nvd_ref | exploit_tag | Exploit-DB ↗ |
EPSS lead: Daily EPSS estimates relative likelihood of exploitation; percentile ranks this CVE among scored vulnerabilities (higher = more severe relative rank).
| # | Date | Old EPSS score | New EPSS score | Delta (New - Old) |
|---|---|---|---|---|
| 1 | 2026-05-30 | 22.38% | 20.12% | -2.26% |
| 2 | 2026-05-29 | 24.51% | 22.38% | -2.13% |
| 3 | 2026-05-25 | — | 24.51% | — |
Full EPSS history (22 records total)
CVSS metrics for this CVE.
| Base score | Version | Severity | Vector | Exploitability | Impact | Score source |
|---|---|---|---|---|---|---|
| 9.8 | 3.1 | CRITICAL |
|
3.9 | 5.9 | [email protected] |
GHSA-399j-vxmf-hjvr · Severity: critical · Ecosystem: npm — @react-native-community/cli has arbitrary OS command injection
| vendor | priority | summary | link |
|---|---|---|---|
redhat
|
high | — | https://access.redhat.com/security/cve/CVE-2025-11953 |
| Vendor | Product | Version | Raw CPE |
|---|---|---|---|
| react-native-community | react_native_community_cli | >= 19.0.0, < 19.1.2 | cpe:2.3:a:react-native-community:react_native_community_cli:*:*:*:*:*:*:*:* |
| react-native-community | react_native_community_cli | 18.0.0 | cpe:2.3:a:react-native-community:react_native_community_cli:18.0.0:*:*:*:*:*:*:* |
| react-native-community | react_native_community_cli | 20.0.0 | cpe:2.3:a:react-native-community:react_native_community_cli:20.0.0:alpha0:*:*:*:*:*:* |
| react-native-community | react_native_community_cli | 20.0.0 | cpe:2.3:a:react-native-community:react_native_community_cli:20.0.0:alpha1:*:*:*:*:*:* |
| react-native-community | react_native_community_cli | 20.0.0 | cpe:2.3:a:react-native-community:react_native_community_cli:20.0.0:alpha2:*:*:*:*:*:* |
| URL | Tags |
|---|---|
| https://github.com/react-native-community/cli/commit/15089907d1f1301b22c72d7f68846a2ef20df547 | Patch |
| https://jfrog.com/blog/cve-2025-11953-critical-react-native-community-cli-vulnerability | Exploit Mitigation Third Party Advisory |
| https://x.com/SzymonRybczak/status/1986199665000566848 | Third Party Advisory |
| https://x.com/thymikee/status/1986770875954475375 | Third Party Advisory |
| https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2025-11953 | US Government Resource |
| https://www.vulncheck.com/blog/metro4shell_eitw | Exploit Third Party Advisory |