Critical OS Command Injection Report: CVE-2025-11953

1. Executive Summary

CVE-2025-11953 is a Critical (CVSS 9.8) OS Command Injection vulnerability found in the React Native Community CLI's Metro development server.

The flaw exists because the Metro dev server's /open-url HTTP endpoint improperly processes user input, passing it directly to an unsafe open() function that executes a system shell command. Since the server binds to all network interfaces by default, an unauthenticated attacker on the same network can send a crafted POST request to this endpoint to execute arbitrary OS commands on the developer's system.

This results in a complete loss of Confidentiality, Integrity, and Availability, potentially leading to full system compromise.

2. Basic Identification & Classification

3. Technical Description

The vulnerability is rooted in the Metro dev server's openURLMiddleware.

1. Default Configuration: When a React Native project starts, the CLI launches the Metro dev server (default port 8081). By default, it listens on all network interfaces (0.0.0.0), making it remotely accessible.
2. Vulnerable Endpoint: The server exposes the POST /open-url HTTP endpoint, which is used internally during development to open files or URLs (e.g., refreshing documentation).
3. Unsafe Command Execution: This endpoint takes a JSON payload, such as `{\"url": ""}`, and calls the open() function from the open NPM package. Crucially, the open() call executes a system shell command to open the provided URL.
4. OS Command Injection: Metro does not sanitize the user-supplied url value before passing it to the command execution. An attacker can embed shell metacharacters (like &&, ;, |) into the url value to inject and execute arbitrary OS commands.

🗺 Attack Mapping

The attack requires no authentication or specific user interaction. An attacker only needs network access to the developer's machine on port 8081.

Example Payload (Windows):
A request containing {"url":"C:\Windows\system.ini" && calc.exe"} will cause the server to execute the system command, launching calc.exe in addition to its intended function. This technique grants the attacker full shell command execution.

Note: Frameworks like Expo that use a different development server are generally not affected by this specific vulnerability.

4. Risk Assessment (CVSS v3.1)

5. Remediation and Mitigation

✅ Primary Solution (Patch)

The immediate and definitive solution is to upgrade the affected packages:

• Target Version: Update the @react-native-community/cli-server-api package to v20.0.0 or later.
• CLI Upgrade: Alternatively, update the main React Native CLI to v20.0.0+, which includes the patched component.

🛡 Temporary Mitigations/Workarounds

These steps should be implemented immediately until the patch can be deployed:

1. Bind Metro to Localhost: Prevent remote connections by starting the development server with the --host flag.
   • Example: npx react-native start --host 127.0.0.1
2. Restrict Network Access: Use firewall rules or network access controls (ACLs) to block incoming connections to the Metro port (default 8081) from all untrusted external sources.
3. Monitor & Audit: Watch development logs for suspicious POST requests targeting the /open-url endpoint.

6. References

• NVD: National Vulnerability Database entry for CVE-2025-11953.
• JFrog Security Research: Critical RCE Vulnerability CVE-2025-11953 analysis.
• The Hacker News: Critical React Native CLI Flaw Exposed Millions of Developers to Remote Attacks.
• Snyk: Command Injection in @react-native-community/cli-server-api.
• CCB Belgium: Advisory on Critical React Native CLI vulnerability.