CVE-2025-11953
@react-native-community/cli has arbitrary OS command injection
9.8
CRITICAL
CVSS 3.1
⚠ KEVEPSS 62.4%
描述
The Metro Development Server, which is opened by the React Native CLI, binds to external interfaces by default. The server exposes an endpoint that is vulnerable to OS command injection. This allows unauthenticated network attackers to send a POST request to the server and run arbitrary executables. On Windows, the attackers can also execute arbitrary shell commands with fully controlled arguments.
如何修補 CVE-2025-11953
要修補 CVE-2025-11953,請將受影響套件升級到下列已修補版本。
- —升級至 20.0.0 或更新版本
- —升級至 20.0.0 或更新版本
CVE-2025-11953 正在被利用嗎?
是 — CVE-2025-11953 已列入 CISA Known Exploited Vulnerabilities (KEV) 清單,代表正在被實際利用,請立即修補。
受影響套件(2)
- >= 20.0.0-alpha.0, < 20.0.0
- >= 20.0.0-alpha.0, < 20.0.0
CVSS 分數
| 來源 | 版本 | 嚴重程度 | 向量 |
|---|---|---|---|
| osv | CVSS 3.1 | CRITICAL9.8 | CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H |