{"action":"Upgrade @react-native-community/cli-server-api to 18.0.1 or later.","affected":[{"fixed":"20.0.0","introduced":"20.0.0-alpha.0"},{"fixed":"19.1.2","introduced":"19.0.0-alpha.0"},{"fixed":"18.0.1","introduced":"18.0.0"}],"component":"@react-native-community/cli-server-api","cve_ids":["CVE-2025-11953"],"ecosystem":"npm","epss":0.9398,"exploited":true,"fixed_versions":["20.0.0","19.1.2","18.0.1"],"ghsa_id":"GHSA-399j-vxmf-hjvr","id":"tcs_01M5KEWSYNX3XW7ZZSW70HCKF2","modified_at":"2026-02-05T21:49:39.769167Z","published_at":"2025-11-03T18:31:52Z","references":["https://osv.dev/vulnerability/GHSA-399j-vxmf-hjvr","https://nvd.nist.gov/vuln/detail/CVE-2025-11953","https://github.com/react-native-community/cli/issues/2733#issuecomment-3502424164","https://github.com/react-native-community/cli/pull/1615","https://github.com/react-native-community/cli/commit/15089907d1f1301b22c72d7f68846a2ef20df547","https://github.com/react-native-community/cli/commit/5a792169d9883e0b0fb1ddf1ea46778f21510d18","https://github.com/react-native-community/cli/commit/9e1fa8cc633e5dcf32244ffa60a871880be56722","https://github.com/react-native-community/cli/commit/a8293dc29425f56249753507bc24d87b698d46e1","https://github.com/react-native-community/cli","https://github.com/react-native-community/cli/releases/tag/v20.0.0","https://github.com/react-native-community/cli?tab=readme-ov-file#compatibility","https://jfrog.com/blog/cve-2025-11953-critical-react-native-community-cli-vulnerability","https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2025-11953","https://www.vulncheck.com/blog/metro4shell_eitw","https://x.com/SzymonRybczak/status/1986199665000566848","https://x.com/szymonrybczak/status/1986199665000566848?s=46","https://x.com/thymikee/status/1986770875954475375"],"severity":{"label":"critical","score":9.8},"sources":[{"source":"osv","source_id":"GHSA-399j-vxmf-hjvr#npm/@react-native-community/cli-server-api","url":"https://osv.dev/vulnerability/GHSA-399j-vxmf-hjvr"},{"source":"kev","source_id":"CVE-2025-11953","url":"https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json"}],"summary":"@react-native-community/cli has arbitrary OS command injection"}