A critical remote code execution (RCE) vulnerability in a widely used React Native npm package has left developers exposed to potential attacks, according to security researchers at JFrog.
Designated CVE-2025-11953, the flaw carries a CVSS score of 9.8, indicating high severity due to its ease of exploitation and potential for severe impact.
The issue resides in the @react-native-community/cli-server-api package, part of the React Native Community CLI, which boasts around 2 million weekly downloads on npm.
This toolset is essential for building cross-platform mobile apps with JavaScript, powering projects from standard React Native setups to extensions like React Native for Windows and macOS.
React Native’s popularity stems from its ability to streamline mobile development without deep native coding knowledge.
However, the vulnerability allows unauthenticated attackers to execute arbitrary operating system commands on a developer’s machine by targeting the Metro development server.
Normally, such flaws might remain local, but a secondary issue in React Native’s core codebase exposes the server to external networks by default, binding it to all interfaces (0.0.0.0) instead of localhost.
This combination turns a development oversight into a remote threat, where attackers can send a crafted POST request to the /open-url endpoint, hijacking user input to invoke the unsafe ‘open’ npm package and spawn malicious commands.
Affected Versions and Impact Assessment
The vulnerability impacts @react-native-community/cli-server-api versions from 4.8.0 to 20.0.0-alpha.2.
Developers initializing projects with vulnerable @react-native-community/cli versions (4.8.0 to 20.0.0-alpha.2) and running commands like npm start or npx react-native run-android are at risk, as these launch the exploitable Metro server.
Not all users are affected; those using frameworks like Expo, which bypass Metro, remain safe.
On Windows, exploitation enables full shell command execution with parameter control, as demonstrated by researchers spawning calc.exe or writing files via cmd /c payloads.
On macOS and Linux, limitations in argument handling restrict full RCE, though further research could uncover paths via URI schemes like file:// or smb://.
| CVE ID | Affected Package | Versions Impacted | CVSS v3.1 Score | Vector | Description | Exploit Prerequisites |
|---|---|---|---|---|---|---|
| CVE-2025-11953 | @react-native-community/cli-server-api | 4.8.0 – 20.0.0-alpha.2 | 9.8 (Critical) | AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H | Unsanitized user input in /open-url endpoint passed to ‘open’ package, enabling OS command execution via Metro dev server. | Network access to dev server; POST request with malicious URL payload. No authentication required. |
Mitigation Strategies and Patch Details
To address CVE-2025-11953, update to @react-native-community/cli-server-api version 20.0.0 or later, which patches the input sanitization flaw.
Check for vulnerable installations with npm list @react-native-community/cli-server-api in project directories or globally via npm list -g.
For immediate protection without upgrading, bind the server to localhost using --host 127.0.0.1, as in npx react-native start --host 127.0.0.1.
This limits exposure to local traffic only. Meta’s team swiftly addressed the issue, crediting JFrog for disclosure.
This incident underscores the risks in development tools, where third-party dependencies like the ‘open’ package can introduce subtle dangers.
Developers should integrate static application security testing (SAST) tools early to catch such issues.
As React Native evolves, vigilance in server configurations remains crucial to safeguard the ecosystem.
 vulnerability in a widely used React Native npm package has left developers exposed to potential){kind=link}