Home / Vulnerabilities / CVE-2025-11953
CRITICAL SEVERITY
CVE-2025-11953 React Native Community · CLI

React Native Community CLI OS Command Injection Vulnerability

Technical Severity

CVSS v3.1 Metrics

CRITICAL
9.8 / 10
Minimal Risk Critical
Vector Specification
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Exploitation Likelihood

EPSS Prediction

6.95 %
Predictive Probability
Percentile Rank
91.2 th

Documented as more likely to be exploited than 91.2% of known CVEs.

Detection Date

Feb 05, 2026

Remediation Due

Feb 26, 2026

CISA Catalog Active

Threat Analysis

React Native Community CLI contains an OS command injection vulnerability which could allow unauthenticated network attackers to send POST requests to the Metro Development Server and run arbitrary executables via a vulnerable endpoint exposed by the server. On Windows, attackers can also execute arbitrary shell commands with fully controlled arguments.

Remediation Directive

Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable.

External Intelligence

This vulnerability could affect an open-source component, third-party library, protocol, or proprietary implementation that could be used by different products. For more information, please see:

https://github.com/react-native-community/cli/commit/15089907d1f1301b22c72d7f68846a2ef20df547

https://github.com/react-native-community/cli/pull/2735

https://github.com/react-native-community/cli/pull/2735
NVD

National Vulnerability Database

https://nvd.nist.gov/vuln/detail/CVE-2025-11953