Critical React Native CLI Flaw (CVE-2025-11953, CVSS 9.8) Allows Unauthenticated RCE via Exposed Metro Server

A newly disclosed critical vulnerability in the React Native Community CLI, CVE-2025-11953 with CVSS 9.8, allows unauthenticated remote code execution via the Metro development server, which binds to external interfaces by default. According to the CVE record, the Metro Development Server exposes an endpoint vulnerable to OS command injection, meaning that when developers start a local React Native project, the internal server may be reachable from external networks.

An unauthenticated attacker on the same network can exploit this by sending crafted POST requests to execute arbitrary commands on the host operating system, with Windows users able to run arbitrary PowerShell or CMD commands. The flaw affects all versions from 4.8.0 before 20.0.0, with a fixed version 20.0.0 and later released.

Given the ecosystem’s wide adoption, the exposure surface is substantial, as the React Native CLI is used across cross‑platform mobile app development and the affected component handles development workstations that may hold credentials and tokens.