CVE-2025-11953

CRITICAL9.8⚠ KEVEPSS 27.9%

@react-native-community/cli has arbitrary OS command injection

發布日:2025/11/3修改日:2026/2/5加入 CISA KEV 日:2026/2/5

描述

The Metro Development Server, which is opened by the React Native CLI, binds to external interfaces by default. The server exposes an endpoint that is vulnerable to OS command injection. This allows unauthenticated network attackers to send a POST request to the server and run arbitrary executables. On Windows, the attackers can also execute arbitrary shell commands with fully controlled arguments.

受影響套件(2)

npm/@react-native-community/cli>= 20.0.0-alpha.0, < 20.0.0
npm/@react-native-community/cli-server-api>= 20.0.0-alpha.0, < 20.0.0

CVSS 分數

來源	版本	嚴重程度	向量
osv	CVSS 3.1	CRITICAL9.8	CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

參考連結(16)

ADVISORYhttps://nvd.nist.gov/vuln/detail/CVE-2025-11953
PATCHhttps://github.com/react-native-community/cli
WEBhttps://github.com/react-native-community/cli/commit/15089907d1f1301b22c72d7f68846a2ef20df547
WEBhttps://github.com/react-native-community/cli/commit/5a792169d9883e0b0fb1ddf1ea46778f21510d18
WEBhttps://github.com/react-native-community/cli/commit/9e1fa8cc633e5dcf32244ffa60a871880be56722
WEBhttps://github.com/react-native-community/cli/commit/a8293dc29425f56249753507bc24d87b698d46e1
WEBhttps://github.com/react-native-community/cli/issues/2733#issuecomment-3502424164
WEBhttps://github.com/react-native-community/cli/pull/1615
WEBhttps://github.com/react-native-community/cli/releases/tag/v20.0.0
WEBhttps://github.com/react-native-community/cli?tab=readme-ov-file#compatibility
WEBhttps://jfrog.com/blog/cve-2025-11953-critical-react-native-community-cli-vulnerability
WEBhttps://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2025-11953
WEBhttps://www.vulncheck.com/blog/metro4shell_eitw
WEBhttps://x.com/SzymonRybczak/status/1986199665000566848
WEBhttps://x.com/szymonrybczak/status/1986199665000566848?s=46
WEBhttps://x.com/thymikee/status/1986770875954475375