CVE-2025-11953
Published: 03 November 2025
Summary
CVE-2025-11953 is a critical-severity OS Command Injection (CWE-78) vulnerability in React-Native-Community React Native Community Cli. Its CVSS base score is 9.8 (Critical).
Operationally, exploitation aligns with the MITRE ATT&CK technique Exploit Public-Facing Application (T1190); ranked in the top 4.7% of CVEs by exploit likelihood; CISA has added it to the Known Exploited Vulnerabilities catalog; a public proof-of-concept is referenced.
The strongest mitigations our analysis identified are NIST 800-53 CM-6 (Configuration Settings) and SI-10 (Information Input Validation).
Threat & Defense at a Glance
Threat & Defense Details
Mitigating Controls (NIST 800-53 r5)AI
Requires timely identification, reporting, and correction of the command injection flaw in the Metro Development Server via available patches.
Mandates validation of inputs at external interfaces to block OS command injection attacks via POST requests to the vulnerable endpoint.
Enforces secure configuration settings to bind the development server only to localhost, preventing exposure to unauthenticated network attackers.
MITRE ATT&CK Enterprise TechniquesAI
Why these techniques?
Unauthenticated remote command injection in a publicly exposed development server directly enables exploitation of public-facing applications (T1190) and execution of arbitrary Windows shell commands (T1059.003).
NVD Description
The Metro Development Server, which is opened by the React Native Community CLI, binds to external interfaces by default. The server exposes an endpoint that is vulnerable to OS command injection. This allows unauthenticated network attackers to send a POST…
more
request to the server and run arbitrary executables. On Windows, the attackers can also execute arbitrary shell commands with fully controlled arguments.
Deeper analysisAI
CVE-2025-11953, published on 2025-11-03, is a critical OS command injection vulnerability (CWE-78) in the Metro Development Server launched by the React Native Community CLI. By default, the server binds to external interfaces and exposes an endpoint vulnerable to command injection, with a CVSS v3.1 base score of 9.8 (AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H).
Unauthenticated network attackers can exploit the vulnerability by sending a POST request to the affected endpoint, enabling execution of arbitrary executables. On Windows, attackers gain the ability to execute arbitrary shell commands with fully controlled arguments.
A patch addressing the issue is available in the React Native Community CLI via the commit at https://github.com/react-native-community/cli/commit/15089907d1f1301b22c72d7f68846a2ef20df547. Further details on the vulnerability and mitigation are provided in the JFrog advisory at https://jfrog.com/blog/cve-2025-11953-critical-react-native-community-cli-vulnerability. The vulnerability appears in CISA's Known Exploited Vulnerabilities Catalog at https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2025-11953, signaling active real-world exploitation.
Details
- CWE(s)
- KEV Date Added
- 05 February 2026