Critical RCE Bug in Leading React Native NPM Module Could Allow Full System Compromise

Security researchers from JFrog recently uncovered CVE-2025-11953, a critical remote code execution flaw affecting the @react-native-community/cli-server-api package used with React Native, which attracts approximately two million weekly downloads. The vulnerability stems from unsafe handling of user input in the Metro development server’s /open-url endpoint, where unsanitised data can be passed to the open function, enabling the execution of system commands without authentication.

The flaw carries a maximum CVSS score of 9.8 and affects versions 4.8.0 through 20.0.0-alpha.2, with a patch released in version 20.0.0. Exploitation could allow remote attackers to run arbitrary operating system commands on machines running the development server, with demonstrations showing full command execution on Windows.

The advisory also notes a separate issue where the server binds to all network interfaces instead of localhost, turning a local risk into a remotely exploitable one, and it recommends updating to 20.0.0 or higher or binding the server to localhost as a mitigation.