Critical React Native CLI Flaw Exposed Millions of Developers to Remote Attacks

A critical flaw in the React Native CLI has been patched after it enabled remote command execution on developers’ machines. The vulnerability, tracked as CVE-2025-11953 with a CVSS score of 9.8, affects the @react-native-community/cli-server-api package versions 4.8.0 through 20.0.0-alpha.2 and was fixed in version 20.0.0 released early last month.

According to JFrog Senior Security Researcher Or Peles, the bug allowed remote unauthenticated attackers to trigger OS commands on the machine running the React Native development server. The issue arises because the Metro development server binds to external interfaces by default and exposes an /open-url endpoint susceptible to OS command injection via a POST request containing user input passed to the unsafe open() function.

An attacker could exploit this by sending a specially crafted POST request, with Windows capable of executing arbitrary shell commands and Linux/macOS able to run arbitrary binaries with limited parameter control. The React Native CLI command-line tools package is maintained by Meta and typically records between 1.5 million and 2 million downloads per week.