CVE-2025-11953
Published: 03 November 2025
Description
Adversaries may abuse the Windows command shell for execution.
Security Summary
CVE-2025-11953, published on 2025-11-03, is a critical OS command injection vulnerability (CWE-78) in the Metro Development Server launched by the React Native Community CLI. By default, the server binds to external interfaces and exposes an endpoint vulnerable to command injection, with a CVSS v3.1 base score of 9.8 (AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H).
Unauthenticated network attackers can exploit the vulnerability by sending a POST request to the affected endpoint, enabling execution of arbitrary executables. On Windows, attackers gain the ability to execute arbitrary shell commands with fully controlled arguments.
A patch addressing the issue is available in the React Native Community CLI via the commit at https://github.com/react-native-community/cli/commit/15089907d1f1301b22c72d7f68846a2ef20df547. Further details on the vulnerability and mitigation are provided in the JFrog advisory at https://jfrog.com/blog/cve-2025-11953-critical-react-native-community-cli-vulnerability. The vulnerability appears in CISA's Known Exploited Vulnerabilities Catalog at https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2025-11953, signaling active real-world exploitation.
Details
- CWE(s)
- KEV Date Added
- 05 February 2026
Affected Products
MITRE ATT&CK Enterprise Techniques
Why these techniques?
Unauthenticated remote command injection in a publicly exposed development server directly enables exploitation of public-facing applications (T1190) and execution of arbitrary Windows shell commands (T1059.003).