CVE-2025-11953
React Native Community — React Native Community CLI OS Command Injection Vulnerability
React Native Community · CWE-78 — Operating system command injection · in CISA KEV since 2026-02-05
EVRS 88 of 100 Immediate
Out-of-Band / Urgent Remediation
Rank 184 of 2,960 tracked
Why it scores 88
Evidence available: 6 of 7 signalsListed in the CISA KEV catalog, and an EPSS probability of 0.940.
- CISA KEVApplied
- RansomwareDid not apply
- Vendor exploitationDid not apply
- EPSSApplied
- Microsoft Exploitability IndexNot applicable
- Pre-patch disclosureNo data
- KEV recencyDid not apply
- CVSSApplied
The band answers “how soon”, not “how bad”. No data for: Pre-patch disclosure. Why some signals show no data
Fix
Patch or fixed version identifiedCISA required action
- This vulnerability could affect an open-source component, third-party library, protocol, or proprietary implementation that could be used by different products. For more information, please see
- github.com/…/2735
- nvd.nist.gov/…/CVE-2025-11953
Fixed in
- @react-native-community/cli
20.0.019.1.218.0.1update to this version or later in your release line - @react-native-community/cli-server-api
20.0.019.1.218.0.1update to this version or later in your release line
Affected versions
- @react-native-community/cli (npm)
affected >= 20.0.0-alpha.0, < 20.0.0, fixed in 20.0.0affected >= 19.0.0-alpha.0, < 19.1.2, fixed in 19.1.2affected >= 18.0.0, < 18.0.1, fixed in 18.0.1 - @react-native-community/cli-server-api (npm)
affected >= 20.0.0-alpha.0, < 20.0.0, fixed in 20.0.0affected >= 19.0.0-alpha.0, < 19.1.2, fixed in 19.1.2affected >= 18.0.0, < 18.0.1, fixed in 18.0.1
Remediation
Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable.
Fixed versions from NVD and GitHub. Affected packages also in GitHub Advisory GHSA-399j-vxmf-hjvr (CC BY 4.0).
Evidence
Each value with its source| Measure | Value | Source |
|---|---|---|
| CVSS base scoreHow severe the flaw is in itself. It does not say how likely an attack is. | 9.8 | NVD |
| FIRST EPSSFIRST's estimate of the chance this is exploited in the next 30 days, and how that ranks against all CVEs. | 0.940 (99.85th pctl) | FIRST EPSS |
| Actively exploitedWhether a source of record has confirmed attacks using it in the wild. | Confirmed | CISA KEV |
| Ransomware campaign useWhether CISA has seen ransomware operators use it. | Unknown or none | CISA KEV |
| CISA remediation deadlineThe date US federal agencies must have fixed or mitigated it. | 2026-02-26 · CISA federal deadline · Overdue by 8 months | CISA KEV |
| Public exploit moduleA module existing is not the same as active exploitation. | None known | Metasploit |
| EUVD cross-referenceENISA's record: CVSS 9.8 (v3.1), assigned by JFROG. | Listed | ENISA EUVD |
Description
NVDThe Metro Development Server, which is opened by the React Native Community CLI, binds to external interfaces by default. The server exposes an endpoint that is vulnerable to OS command injection. This allows unauthenticated network attackers to send a POST request to the server and run arbitrary executables. On Windows, the attackers can also execute arbitrary shell commands with fully controlled arguments.
What CISA says to do