CVE entry · CVE-2025-11953
CVE-2025-11953: React Native Community CLI OS Command Injection Vulnerability
React Native Community CLI contains an OS command injection vulnerability which could allow unauthenticated network attackers to send POST requests to the Metro Development Server and run arbitrary executables via a vulnerable endpoint exposed by the server. On Windows, attackers can also execute arbitrary shell commands with fully controlled arguments.
- Actively exploited: added to CISA’s KEV catalog on February 5, 2026.
- Use by ransomware: not established so far.
- Remediation deadline for US federal agencies: February 26, 2026.
Description from CISA’s KEV catalog.
What to do
- Check whether your estate includes React Native Community CLI, including internet-facing devices.
- Apply the vendor’s patch or mitigations (references below). Failing that, isolate the product or stop using it, as CISA requires of US federal agencies.
- An exploited vulnerability has often been used before it was fixed: look for signs of compromise, especially on internet-facing devices.