Cyber Posture

CVE-2025-11953

CriticalCISA KEVActive ExploitationPublic PoC

Published: 03 November 2025

Published
03 November 2025
Modified
06 February 2026
KEV Added
05 February 2026
Patch
CVSS Score 9.8 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
EPSS Score 0.1862 95.3th percentile
Risk Priority 51 60% EPSS · 20% KEV · 20% CVSS

Description

Adversaries may abuse the Windows command shell for execution.

Security Summary

CVE-2025-11953, published on 2025-11-03, is a critical OS command injection vulnerability (CWE-78) in the Metro Development Server launched by the React Native Community CLI. By default, the server binds to external interfaces and exposes an endpoint vulnerable to command injection, with a CVSS v3.1 base score of 9.8 (AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H).

Unauthenticated network attackers can exploit the vulnerability by sending a POST request to the affected endpoint, enabling execution of arbitrary executables. On Windows, attackers gain the ability to execute arbitrary shell commands with fully controlled arguments.

A patch addressing the issue is available in the React Native Community CLI via the commit at https://github.com/react-native-community/cli/commit/15089907d1f1301b22c72d7f68846a2ef20df547. Further details on the vulnerability and mitigation are provided in the JFrog advisory at https://jfrog.com/blog/cve-2025-11953-critical-react-native-community-cli-vulnerability. The vulnerability appears in CISA's Known Exploited Vulnerabilities Catalog at https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2025-11953, signaling active real-world exploitation.

Details

CWE(s)
CWE-78
KEV Date Added
05 February 2026

Affected Products

react-native-community
react native community cli
18.0.0, 20.0.0 · 19.0.0 — 19.1.2

MITRE ATT&CK Enterprise Techniques

T1190 Exploit Public-Facing Application Initial Access
Adversaries may attempt to exploit a weakness in an Internet-facing host or system to initially access a network.
T1059.003 Windows Command Shell Execution
Adversaries may abuse the Windows command shell for execution.
Why these techniques?

Unauthenticated remote command injection in a publicly exposed development server directly enables exploitation of public-facing applications (T1190) and execution of arbitrary Windows shell commands (T1059.003).

Confidence: HIGH · MITRE ATT&CK Enterprise v19.0

References