Critical React Native CLI Vulnerability Exposes Developers to Remote Attacks
Written by Rebecca Uffindell Tue 4 Nov 2025
The JFrog Security Research team has disclosed CVE-2025-11953, a Critical (CVSS 9.8) remote code execution vulnerability affecting the React Native Community CLI development stack.
The vulnerability allows remote unauthenticated attackers to easily trigger arbitrary OS command execution on the machine running react-native-community/cli’s development server, posing a significant risk to developers.
JFrog identified the issue in the @react-native-community/cli-server-api package, versions 4.8.0 to 20.0.0-alpha.2. A POST request to the server’s /open-url endpoint passes unsanitised user input to the open npm package, enabling OS-level command execution, with full parameter control on Windows systems.
React Native is a popular framework for building cross-platform mobile apps using JavaScript. The vulnerability is in a package which is part of the broader React Native Community CLI project, which was extracted from the core react-native codebase a few years ago to improve maintainability.
The CLI is a collection of command-line tools that help developers build React Native mobile applications. It is officially used for creating React Native mobile apps without using a framework, as well as React Native for Windows, React Native for macOS, and more.
Unlike typical vulnerabilities in development servers that are only exploitable from a developer’s local machine, a second security issue that the team spotted in React Native’s core codebase exposes the development server to external network attacks, making the former vulnerability a highly critical issue.
Who Is Affected
Developers who initiated their React Native project with a vulnerable version of @react-native-community/cli, and run the Metro development server via one of the following or similar commands, are vulnerable to CVE-2025-11953:
npm start
npm run [start|android|ios|windows|macos]
npx react-native [start|run-android|run-ios|run-windows|run-macos]
npx @react-native-community/cli [start|run-android|run-ios|run-windows|run-macos]
JFrog said that while the vulnerability is exploitable by default when initiating a react-native project using @react-native-community/cli, it is important to understand that not every developer who has this library installed as a dependency is necessarily vulnerable.
Specifically, developers who use React Native with a framework that doesn’t use Metro as the development server are typically not vulnerable.
The vulnerability directly affects the @react-native-community/cli-server-api package, versions 4.8.0 to 20.0.0-alpha.2, and is fixed since version 20.0.0.
Mitigation and Security Recommendations
Performing the following steps will mitigate CVE-2025-11953:
- Update @react-native-community/cli-server-api to version 20.0.0 (or higher), which includes a fix for this vulnerability, in each of your react-native projects. This is the recommended solution.
- For improved security, or if upgrading is not possible, prefer binding the development server to the localhost interface explicitly, by including the “–host 127.0.0.1” flag, per the example below:
npm start –host 127.0.0.1
npx react-native start –host 127.0.0.1
Context and Coordination
JFrog credited Meta’s security team and React Native engineers for rapid coordination ahead of disclosure. The researchers noted that even straightforward remote code execution flaws, such as passing user input directly to system commands, remain common in real-world software, underscoring the importance of secure coding practices and automated dependency scanning in development pipelines.
The full technical breakdown and remediation details will be available via the JFrog Security Research Center.
Written by Rebecca Uffindell Tue 4 Nov 2025