Critical Flaw in Popular React Native NPM Package Exposes Developers to Attacks

SecurityWeek reports a critical flaw in the popular React Native NPM package (@react-native-community/cli) tracked as CVE-2025-11953, which carries a CVSS score of 9.8 and is associated with roughly two million weekly downloads. According to JFrog, the vulnerability can let unauthenticated threat actors execute arbitrary commands with attacker-controlled parameters via POST requests to the targeted server, and a second issue in React Native’s core codebase exposes the development server to external network attacks.

Researchers demonstrated arbitrary OS command execution on Windows with full parameter control, while on Linux and macOS they achieved code execution with limited parameter control, though the impact may be higher on those platforms. The flaw is exploitable for developers using a vulnerable version of the NPM package and relying on the Metro development server, and it was quickly patched by Meta, the original developer of React Native.

A patch for CVE-2025-11953 is included in version 20.0.0, with a recommendation to update @react-native-community/cli-server-api to this version or higher in each project. 4 November 2025.