Loading story…
A critical vulnerability, tracked as CVE-2025-11953, was discovered in the @react-native-community/cli npm package, which is widely used for developing React Native mobile applications. The flaw, rated with a CVSS score of 9.8, allows unauthenticated remote attackers to execute arbitrary operating system commands on machines running the React Native CLI's development server. The vulnerability stems from the Metro development server binding to external interfaces by default and exposing an /open-url endpoint that is susceptible to OS command injection. Attackers can exploit this by sending specially crafted POST requests, leading to remote code execution. On Windows systems, attackers can execute arbitrary shell commands with full argument control, while on Linux and macOS, arbitrary binaries can be executed with limited parameter control.
The issue affects versions 4.8.0 through 20.0.0-alpha.2 of the @react-native-community/cli-server-api package and has been patched in version 20.0.0. The vulnerability posed a significant risk to millions of developers, as the package receives up to 2 million downloads per week. The flaw has since been addressed, but organizations using affected versions are urged to update immediately to mitigate the risk of exploitation. The vulnerability was reported by JFrog researchers and publicly disclosed in early November 2025.
Mallory correlates global threat intelligence with your attack surface — know if you’re exposed before adversaries strike.
5 events from the most recent confirmed update back to the earliest known activity.
Security coverage recommended immediate mitigation for unpatched environments by restricting the React Native development server to localhost instead of exposing it on all network interfaces. This guidance was issued alongside calls to update to secure versions.
Public reporting detailed that the Metro development server binds to 0.0.0.0 by default and that its /open-url endpoint passes attacker-controlled input to the open NPM package, enabling arbitrary OS command execution. Reports also noted Windows systems were especially at risk, though macOS and Linux could also be affected.
Meta released fixes for the React Native CLI vulnerability, with reports indicating the issue is fixed in version 20.0.0. Developers were advised to upgrade to patched versions to prevent exploitation.
CVE-2025-11953 was publicly listed as a high-severity vulnerability affecting React Native CLI, describing a command injection issue that allows remote attackers to achieve remote code execution by sending HTTP requests. Public disclosure established the issue as a tracked vulnerability.
JFrog researchers identified a critical command injection vulnerability in the @react-native-community/cli and its server API that could allow unauthenticated remote code execution through the Metro development server. The flaw was later tracked as CVE-2025-11953 and affects versions 4.8.0 through 20.0.0-alpha.2.
Vulnerabilities, threat actors, malware, products, organizations, and breaches Mallory has linked to this story.
6 references tracked. Mallory keeps watching after this page renders.
csoonline.com
Open sourcesecurityonline.info
Open sourcescworld.com
Open sourcehackread.com
Open sourcethehackernews.com
Open sourcecvefeed.io
Open sourceMap indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
Attackers in 2025 rapidly exploited both new and longstanding vulnerabilities, with mass scanning and weaponization occurring within hours of disclosure. The most targeted weaknesses included deserialization flaws, memory corruption in edge devices, and privilege escalation bugs, with some vulnerabilities—such as those in React Server Components and Microsoft WSUS—being compared to Log4Shell in terms of scale and impact. The Top 25 exploited vulnerabilities of the year highlighted systemic failures in patch management and asset visibility, as attackers leveraged both recent and decade-old flaws to gain initial access, deploy webshells, and compromise CI/CD pipelines. Among the most critical issues was CVE-2025-11953, a remote code execution vulnerability in the React Native Community CLI’s Metro development server. This flaw, caused by unsanitized user input in the `@react-native-community/cli-server-api` package, allowed unauthenticated attackers to execute arbitrary OS commands via exposed HTTP endpoints. The vulnerability posed significant supply chain risks to mobile app development environments, enabling attackers to compromise developer workstations, steal credentials, and potentially pivot into corporate networks. Multiple national CERTs and security vendors issued urgent alerts and mitigation guidance due to the high exploitability and widespread exposure of this vulnerability.
Jun 29, 2026
Threat actors have been observed exploiting **CVE-2025-11953** (aka **Metro4Shell**), a critical RCE flaw (CVSS **9.8**) in the React Native **Metro Development Server** exposed via the `@react-native-community/cli` / `@react-native-community/cli-server-api` npm packages. The issue stems from Metro’s development-only `/open-url` HTTP endpoint accepting attacker-controlled input that can be passed unsanitized to an `open()` call; under default configurations Metro may bind to external interfaces, making developer systems reachable from the internet. JFrog disclosed the vulnerability in November 2025, and multiple proof-of-concept exploits emerged after public disclosure; affected versions were reported as `@react-native-community/cli-server-api` **4.8.0 through 20.0.0-alpha.2**, with a fix in **20.0.0+**. VulnCheck telemetry and honeypot/canary observations indicate operational exploitation beginning **Dec 21, 2025**, with repeat activity on **Jan 4** and **Jan 21, 2026**, delivering consistent payloads rather than one-off probing. Observed attacks used **Base64-encoded PowerShell** delivered in HTTP POST bodies to exposed endpoints; the script added **Microsoft Defender** exclusions (including the current working directory and `C:\Users\<Username>\AppData\Local\Temp`), established a raw TCP connection to `8.218.43[.]248:60124`, downloaded an additional payload to the temp directory, and executed it. The downloaded binary was described as **Rust-based** with anti-analysis checks, and exploitation attempts were reported as originating from `5.109.182[.]231`, `223.6.249[.]141`, and `134.209.69[.]155`, underscoring the risk of internet-exposed development infrastructure being used as an initial access vector.
Jun 29, 2026
A critical remote code execution vulnerability, dubbed **React2Shell**, was discovered in the React 19 library, specifically affecting React Server Components. The flaw allows unauthenticated attackers to execute arbitrary code on servers by sending crafted requests, making it a severe risk for organizations using default React and Next.js deployments. Within hours of public disclosure, security firms including Google’s Threat Intelligence Group and AWS confirmed active exploitation in the wild, highlighting the shrinking window between vulnerability awareness and real-world attacks. Researchers from Wiz and Unit 42 demonstrated that even clean, default deployments were susceptible, emphasizing the widespread impact due to the popularity of these frameworks. Threat actors rapidly weaponized the React2Shell vulnerability, with the RondoDoX botnet launching automated exploitation campaigns targeting both web applications and IoT devices. CloudSEK’s analysis of command and control logs revealed a multi-month campaign, with a significant spike in attacks following the vulnerability’s disclosure in December 2025. The RondoDoX botnet deployed various payloads, including web shells and cryptominers, and quickly adapted its infrastructure in response to security firm reports. Organizations with technology stacks overlapping the targeted vectors were promptly alerted, underscoring the urgent need for patching and monitoring in environments using React 19 and Next.js.
Jun 29, 2026