Critical OS Command Injection Report: CVE-2025-11953

1. Executive Summary

CVE-2025-11953 is a Critical (CVSS 9.8) OS Command Injection vulnerability found in the React Native Community CLI's Metro development server.

The flaw exists because the Metro dev server's /open-url HTTP endpoint improperly processes user input, passing it directly to an unsafe open() function that executes a system shell command. Since the server binds to all network interfaces by default, an unauthenticated attacker on the same network can send a crafted POST request to this endpoint to execute arbitrary OS commands on the developer's system.

This results in a complete loss of Confidentiality, Integrity, and Availability, potentially leading to full system compromise.

2. Basic Identification & Classification

3. Technical Description

The vulnerability is rooted in the Metro dev server's openURLMiddleware.

1. Default Configuration: When a React Native project starts, the CLI launches the Metro dev server (default port 8081). By default, it listens on all network interfaces (0.0.0.0), making it remotely accessible.
2. Vulnerable Endpoint: The server exposes the POST /open-url HTTP endpoint, which is used internally during development to open files or URLs (e.g., refreshing documentation).
3. Unsafe Command Execution: This endpoint takes a JSON payload, such as `{\"url": ""}`, and calls the open() function from the open NPM package. Crucially, the open() call executes a system shell command to open the provided URL.
4. OS Command Injection: Metro does not sanitize the user-supplied url value before passing it to the command execution. An attacker can embed shell metacharacters (like &&, ;, |) into the url value to inject and execute arbitrary OS commands.

🗺 Attack Mapping

The attack requires no authentication or specific user interaction. An attacker only needs network access to the developer's machine on port 8081.

Example Payload (Windows):
A request containing {"url":"C:\Windows\system.ini" && calc.exe"} will cause the server to execute the system command, launching calc.exe in addition to its intended function. This technique grants the attacker full shell command execution.

Una comparación útil de camisetas de fútbol por selección comienza por los colores, el escudo y los detalles del diseño. Antes de pagar, es útil verificar que la descripción no mezcle versiones de temporadas distintas.

Note: Frameworks like Expo that use a different development server are generally not affected by this specific vulnerability.

4. Risk Assessment (CVSS v3.1)

5. Remediation and Mitigation

✅ Primary Solution (Patch)

The immediate and definitive solution is to upgrade the affected packages:

• Target Version: Update the @react-native-community/cli-server-api package to v20.0.0 or later.
• CLI Upgrade: Alternatively, update the main React Native CLI to v20.0.0+, which includes the patched component.

🛡 Temporary Mitigations/Workarounds

These steps should be implemented immediately until the patch can be deployed:

1. Bind Metro to Localhost: Prevent remote connections by starting the development server with the --host flag.
   • Example: npx react-native start --host 127.0.0.1
2. Restrict Network Access: Use firewall rules or network access controls (ACLs) to block incoming connections to the Metro port (default 8081) from all untrusted external sources.
3. Monitor & Audit: Watch development logs for suspicious POST requests targeting the /open-url endpoint.

6. References

• NVD: National Vulnerability Database entry for CVE-2025-11953.
• JFrog Security Research: Critical RCE Vulnerability CVE-2025-11953 analysis.
• The Hacker News: Critical React Native CLI Flaw Exposed Millions of Developers to Remote Attacks.
• Snyk: Command Injection in @react-native-community/cli-server-api.
• CCB Belgium: Advisory on Critical React Native CLI vulnerability.