npm/@react-native-community/cli-server-api CVE-2025-11953: critical 9.8, exploited, EPSS 93.98%

@react-native-community/cli has arbitrary OS command injection

Action: Upgrade @react-native-community/cli-server-api to 18.0.1 or later.

npm i @react-native-community/cli-server-api@20.0.0

npm i @react-native-community/cli-server-api@19.1.2

npm i @react-native-community/cli-server-api@18.0.1

Affected

Fixed versions

Sources

• osv: GHSA-399j-vxmf-hjvr#npm/@react-native-community/cli-server-api
• kev: CVE-2025-11953
• https://nvd.nist.gov/vuln/detail/CVE-2025-11953
• https://github.com/react-native-community/cli/issues/2733#issuecomment-3502424164
• https://github.com/react-native-community/cli/pull/1615
• https://github.com/react-native-community/cli/commit/15089907d1f1301b22c72d7f68846a2ef20df547
• https://github.com/react-native-community/cli/commit/5a792169d9883e0b0fb1ddf1ea46778f21510d18
• https://github.com/react-native-community/cli/commit/9e1fa8cc633e5dcf32244ffa60a871880be56722
• https://github.com/react-native-community/cli/commit/a8293dc29425f56249753507bc24d87b698d46e1
• https://github.com/react-native-community/cli
• https://github.com/react-native-community/cli/releases/tag/v20.0.0
• https://github.com/react-native-community/cli?tab=readme-ov-file#compatibility
• https://jfrog.com/blog/cve-2025-11953-critical-react-native-community-cli-vulnerability
• https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2025-11953
• https://www.vulncheck.com/blog/metro4shell_eitw
• https://x.com/SzymonRybczak/status/1986199665000566848
• https://x.com/szymonrybczak/status/1986199665000566848?s=46
• https://x.com/thymikee/status/1986770875954475375

CVE-2025-11953 · published 2025-11-03T18:31:52Z · modified 2026-02-05T21:49:39.769167Z · JSON