CVE-2025-11953
2 advisories.
npm/@react-native-community/cli CVE-2025-11953: critical 9.8, exploited, EPSS 93.98%
@react-native-community/cli has arbitrary OS command injection
Action: Upgrade @react-native-community/cli to 18.0.1 or later.
npm i @react-native-community/cli@20.0.0npm i @react-native-community/cli@19.1.2npm i @react-native-community/cli@18.0.1Affected
| introduced | fixed | last affected |
|---|---|---|
| 20.0.0-alpha.0 | 20.0.0 | - |
| 19.0.0-alpha.0 | 19.1.2 | - |
| 18.0.0 | 18.0.1 | - |
Fixed versions
| 20.0.0 | 19.1.2 | 18.0.1 |
Sources
- osv: GHSA-399j-vxmf-hjvr
- kev: CVE-2025-11953
- https://nvd.nist.gov/vuln/detail/CVE-2025-11953
- https://github.com/react-native-community/cli/issues/2733#issuecomment-3502424164
- https://github.com/react-native-community/cli/pull/1615
- https://github.com/react-native-community/cli/commit/15089907d1f1301b22c72d7f68846a2ef20df547
- https://github.com/react-native-community/cli/commit/5a792169d9883e0b0fb1ddf1ea46778f21510d18
- https://github.com/react-native-community/cli/commit/9e1fa8cc633e5dcf32244ffa60a871880be56722
- https://github.com/react-native-community/cli/commit/a8293dc29425f56249753507bc24d87b698d46e1
- https://github.com/react-native-community/cli
- https://github.com/react-native-community/cli/releases/tag/v20.0.0
- https://github.com/react-native-community/cli?tab=readme-ov-file#compatibility
- https://jfrog.com/blog/cve-2025-11953-critical-react-native-community-cli-vulnerability
- https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2025-11953
- https://www.vulncheck.com/blog/metro4shell_eitw
- https://x.com/SzymonRybczak/status/1986199665000566848
- https://x.com/szymonrybczak/status/1986199665000566848?s=46
- https://x.com/thymikee/status/1986770875954475375
CVE-2025-11953 · published · modified · JSON
npm/@react-native-community/cli-server-api CVE-2025-11953: critical 9.8, exploited, EPSS 93.98%
@react-native-community/cli has arbitrary OS command injection
Action: Upgrade @react-native-community/cli-server-api to 18.0.1 or later.
npm i @react-native-community/cli-server-api@20.0.0npm i @react-native-community/cli-server-api@19.1.2npm i @react-native-community/cli-server-api@18.0.1Affected
| introduced | fixed | last affected |
|---|---|---|
| 20.0.0-alpha.0 | 20.0.0 | - |
| 19.0.0-alpha.0 | 19.1.2 | - |
| 18.0.0 | 18.0.1 | - |
Fixed versions
| 20.0.0 | 19.1.2 | 18.0.1 |
Sources
- osv: GHSA-399j-vxmf-hjvr#npm/@react-native-community/cli-server-api
- kev: CVE-2025-11953
- https://nvd.nist.gov/vuln/detail/CVE-2025-11953
- https://github.com/react-native-community/cli/issues/2733#issuecomment-3502424164
- https://github.com/react-native-community/cli/pull/1615
- https://github.com/react-native-community/cli/commit/15089907d1f1301b22c72d7f68846a2ef20df547
- https://github.com/react-native-community/cli/commit/5a792169d9883e0b0fb1ddf1ea46778f21510d18
- https://github.com/react-native-community/cli/commit/9e1fa8cc633e5dcf32244ffa60a871880be56722
- https://github.com/react-native-community/cli/commit/a8293dc29425f56249753507bc24d87b698d46e1
- https://github.com/react-native-community/cli
- https://github.com/react-native-community/cli/releases/tag/v20.0.0
- https://github.com/react-native-community/cli?tab=readme-ov-file#compatibility
- https://jfrog.com/blog/cve-2025-11953-critical-react-native-community-cli-vulnerability
- https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2025-11953
- https://www.vulncheck.com/blog/metro4shell_eitw
- https://x.com/SzymonRybczak/status/1986199665000566848
- https://x.com/szymonrybczak/status/1986199665000566848?s=46
- https://x.com/thymikee/status/1986770875954475375
CVE-2025-11953 · published · modified · JSON