--- title: Critical Vulnerability in React Native CLI Exposes... description: A critical vulnerability (CVE-2025-11953, severity 9.8) in React Native CLI versions 4.8.0 through 20.0.0-alpha.2 allows unauthenticated remote attackers to... canonical: https://daily.dev/posts/critical-vulnerability-in-react-native-cli-exposes-developers-to-remote-code-execution-3zku8nb7f twitter:card: summary_large_image twitter:site: @dailydotdev og:type: website og:site_name: daily.dev og:title: Critical Vulnerability in React Native CLI Exposes Developers to Remote Code Execution | daily.dev og:description: A critical vulnerability (CVE-2025-11953, severity 9.8) in React Native CLI versions 4.8.0 through 20.0.0-alpha.2 allows unauthenticated remote attackers to... og:url: https://daily.dev/posts/critical-vulnerability-in-react-native-cli-exposes-developers-to-remote-code-execution-3zku8nb7f og:image: https://api.daily.dev/og/posts/3zKu8NB7f.png og:image:alt: Critical Vulnerability in React Native CLI Exposes Developers to Remote Code Execution og:image:width: 1200 og:image:height: 630 og:locale: en --- > ## Documentation Index > Fetch the complete documentation index at: https://daily.dev/llms.txt > Use this file to discover all available pages before exploring further. # Critical Vulnerability in React Native CLI Exposes Developers to Remote Code Execution **[Collections](https://daily.dev/sources/collections)** · 2 min read · 1 upvotes · 0 comments ## Summary A critical vulnerability (CVE-2025-11953, severity 9.8) in React Native CLI versions 4.8.0 through 20.0.0-alpha.2 allows unauthenticated remote attackers to execute arbitrary OS commands through the Metro development server's `/open-url` endpoint. The flaw stems from the server binding to all network interfaces instead of localhost, combined with unsanitized user inputs. Meta has released a patch in version 20.0.0, and developers should update immediately or use the `--host 127.0.0.1` flag as a temporary mitigation. ## Content A critical vulnerability named CVE-2025-11953 with a severity score of 9.8 has been uncovered in the React Native CLI, affecting versions 4.8.0 through 20.0.0-alpha.2. This flaw has significant implications for millions of developers, given the CLI's widespread use with over two million downloads weekly. The vulnerability is found in the `@react-native-community/cli` package, specifically in the Metro development server. It allows unauthenticated remote attackers to execute arbitrary OS commands via the `/open-url` endpoint. This endpoint was exposed to external interfaces due to the server binding to all network interfaces (0.0.0.0) rather than being restricted to localhost, thereby facilitating the exploitation of the vulnerability through command injection. The inherent risk lies in unsanitized user inputs being passed to system functions, enabling malicious command execution on affected systems, especially those running Windows. As a response, Meta has released a patch in version 20.0.0, which developers are urged to adopt without delay. For developers unable to immediately update, a temporary mitigation involves configuring the development server to bind only to localhost using the `--host 127.0.0.1` flag. This incident underscores the critical need for robust security practices in managing third-party dependencies and ensuring supply-chain integrity. JFrog Security Research, which discovered this vulnerability, emphasizes the ongoing challenges in securing software supply chains and the necessity for cybersecurity teams to stay vigilant and regularly update development tools to protect against such threats. ## Similar posts on daily.dev - [Critical React Native Metro dev server bug under attack](https://daily.dev/posts/critical-react-native-metro-dev-server-bug-under-attack-fovx3i1ys) · The Register · 0 upvotes · 0 comments --- Tags: [#security](https://daily.dev/tags/security), [#devops](https://daily.dev/tags/devops), [#vulnerability](https://daily.dev/tags/vulnerability), [#cli](https://daily.dev/tags/cli), [#react-native](https://daily.dev/tags/react-native) [View this post on daily.dev](https://daily.dev/posts/critical-vulnerability-in-react-native-cli-exposes-developers-to-remote-code-execution-3zku8nb7f) ```json {"@context":"https://schema.org","@graph":[{"@type":"Organization","@id":"https://daily.dev/#organization","name":"daily.dev","url":"https://daily.dev","logo":{"@type":"ImageObject","url":"https://daily.dev/apple-touch-icon.png","width":180,"height":180},"sameAs":["https://twitter.com/dailydotdev","https://github.com/dailydotdev","https://www.linkedin.com/company/daily-dev-ltd"]},{"@type":"WebSite","@id":"https://daily.dev/#website","url":"https://daily.dev","name":"daily.dev","publisher":{"@id":"https://daily.dev/#organization"},"potentialAction":{"@type":"SearchAction","target":{"@type":"EntryPoint","urlTemplate":"https://daily.dev/search?q={search_term_string}"},"query-input":"required name=search_term_string"}}]} {"@context":"https://schema.org","@type":"TechArticle","headline":"Critical Vulnerability in React Native CLI Exposes Developers to Remote Code Execution","url":"https://daily.dev/posts/critical-vulnerability-in-react-native-cli-exposes-developers-to-remote-code-execution-3zku8nb7f","mainEntityOfPage":{"@type":"WebPage","@id":"https://daily.dev/posts/critical-vulnerability-in-react-native-cli-exposes-developers-to-remote-code-execution-3zku8nb7f"},"datePublished":"2025-11-04T15:19:10.639Z","dateModified":"2025-11-06T20:14:39.446Z","description":"A critical vulnerability (CVE-2025-11953, severity 9.8) in React Native CLI versions 4.8.0 through 20.0.0-alpha.2 allows unauthenticated remote attackers to...","image":"https://media.daily.dev/image/upload/f_auto,q_auto/v1/posts/379edeb81c25ce52b5e043b0808726d6?_a=AQAEulh","thumbnailUrl":"https://media.daily.dev/image/upload/f_auto,q_auto/v1/posts/379edeb81c25ce52b5e043b0808726d6?_a=AQAEulh","isAccessibleForFree":true,"articleSection":"Collections","inLanguage":"en","publisher":{"@type":"Organization","name":"daily.dev","url":"https://daily.dev","logo":{"@type":"ImageObject","url":"https://daily.dev/apple-touch-icon.png","width":180,"height":180}},"author":{"@type":"Organization","name":"Collections","logo":"https://media.daily.dev/image/upload/s--fk_6ycEi--/f_auto,q_auto/v1780996001/logos/collections?_a=BAMAMiWQ0","url":"https://daily.dev/sources/collections"},"commentCount":0,"discussionUrl":"https://daily.dev/posts/critical-vulnerability-in-react-native-cli-exposes-developers-to-remote-code-execution-3zku8nb7f","interactionStatistic":[{"@type":"InteractionCounter","interactionType":{"@type":"LikeAction"},"userInteractionCount":1},{"@type":"InteractionCounter","interactionType":{"@type":"CommentAction"},"userInteractionCount":0}],"keywords":"security,devops,vulnerability,cli,react-native","timeRequired":"PT2M"} {"@context":"https://schema.org","@type":"BreadcrumbList","itemListElement":[{"@type":"ListItem","position":1,"name":"Home","item":"https://daily.dev"},{"@type":"ListItem","position":2,"name":"Collections","item":"https://daily.dev/sources/collections"},{"@type":"ListItem","position":3,"name":"Critical Vulnerability in React Native CLI Exposes Developers to Remote Code Execution"}]} ```