CRITICALCVSS 9.8Actively exploited · CISA KEV since 2026-02-05Vulnerability
CVE-2025-11953
React Native Community CLI contains an OS command injection vulnerability which could allow unauthenticated network attackers to send POST requests to the Metro Development Server and run arbitrary executables via a vulnerable endpoint exposed by the server. On Windows, attackers can also execute arbitrary shell commands with fully controlled arguments.
Properties
- Vulnerability name
- React Native Community CLI OS Command Injection Vulnerability
- First seen
- 2026-02-26T17:47:39+00:00
- Cvss score
- 9.8
- Epss score
- 0.9398
- Last seen
- 2026-10-19T12:00:27+00:00
- Due date
- 2026-02-26
- Euvd assigner
- JFROG
- Retrieved at
- 2026-10-21T01:24:47+00:00
- Exploited euvd since
- 2026-02-05T00:00:00+00:00
- Src batch id
- epss_history-20261020T103617Z-728ddd
- Source url
- https://epss.empiricalsecurity.com/epss_scores-2026-10-19.csv.gz
- Date added
- 2026-02-05
- Score
- 9.8
- Euvd base score version
- 3.1
- Fetched at
- 2026-10-20T10:36:20+00:00
- Cvss vector
- CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
- In Signal since
- initial import (Sep 2026)
- Euvd base score
- 9.8
- Vector
- CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
- Vendor project
- React Native Community
Related Entities (14)
MENTIONED_IN (6)
AFFECTS_PRODUCT (5)
DESCRIBES (1)
HAS_WEAKNESS (1)
INVOLVES (1)
Explore deeper with Ninja Signal's threat intelligence graph