Reference page — cumulative record through Sunday, October 4, 2026 UTC. Reference pages update as the archive grows; only dated daily editions are immutable pages of record.

CVE-2025-11953

CVE-2025-11953CRITICAL

@react-native-community/cli-server-api — Command injection in React Native Community CLI allows remote attackers to perform remote code execution by sending HTTP requests

  AV  AC  PR  UI  S  C  I  A   CVSS    EPSS   %ile   KEV
   N   L   N   N  U  H  H  H    9.8   .9398   99.8   YES

AFFECTED
  Product                                 Versions  Fixed
  @react-native-community/cli-server-api  4.8.0 –   —

TIMELINE
  Oct 20  Reserved by JFROG
  Nov 3   Published (CNA: JFROG)
  Feb 5   Added to CISA KEV, remediation due 2026-02-26

CWE-78 · CNA: JFROG · CVSS v3.1 · 6 references · KEV due February 26, 2026

Description

The Metro Development Server, which is opened by the React Native Community CLI, binds to external interfaces by default. The server exposes an endpoint that is vulnerable to OS command injection. This allows unauthenticated network attackers to send a POST request to the server and run arbitrary executables. On Windows, the attackers can also execute arbitrary shell commands with fully controlled arguments.

Lifecycle

Complete event history — 3 events, chronological
Date	Event	Detail
October 20, 2025	Reserved	Reserved by JFROG
November 3, 2025	Published	Published (CNA: JFROG)
February 5, 2026	KEV ADDED	Added to CISA KEV, remediation due 2026-02-26

Affected

Affected products and packages — 1 row
Vendor	Product / Package	Ecosystem	Version introduced	Fixed
—	@react-native-community/cli-server-api	npm	4.8.0	—

Weaknesses

CWE-78

References (6)

https://github.com/react-native-community/cli/commit/15089907d1f1301b22c72d7f68846a2ef20df547 [patch]
https://jfrog.com/blog/cve-2025-11953-critical-react-native-community-cli-vulnerability [technical-description]
https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2025-11953 [government-resource]
https://www.vulncheck.com/blog/metro4shell_eitw [third-party-advisory]
https://x.com/SzymonRybczak/status/1986199665000566848
https://x.com/thymikee/status/1986770875954475375

Authoritative record: CVE-2025-11953 at cve.org

Weaknesses: CWE-78

Ecosystems: npm

About this page

This is a reference page, not a dated page of record. It assembles the complete lifecycle of CVE-2025-11953 from the CVE Program record, NVD enrichment, the CISA KEV catalog, EPSS, and OSV advisories. The box score's numbers (CVSS, EPSS, KEV status) are current as of Sunday, October 4, 2026 UTC and are re-derived as the archive grows; only dated daily editions are immutable pages of record. The authoritative source for this identifier is cve.org.