React Native CLI CVE-2025-11953: Metro Dev Server RCE

What to do

Run npm ls @react-native-community/cli-server-api in every React Native repo and on build machines, including global installs (npm ls -g).
Upgrade to the CLI line that matches your React Native version: 20.1.1 or later where possible, otherwise 19.1.2, 18.0.1 or 17.0.1.
Start Metro with --host 127.0.0.1 (for example npx react-native start --host 127.0.0.1), and add the flag to package.json scripts.
Firewall TCP 8081 on dev VMs, remote workstations and CI runners so Metro is never reachable from the internet or guest Wi-Fi.
On older React Native projects stuck below CLI 17, rely on the localhost binding and firewall, and plan the upgrade.

How to check if you are affected or compromised

Check which address Metro listens on: lsof -nP -iTCP:8081 -sTCP:LISTEN (macOS/Linux) or netstat -ano | findstr :8081 (Windows); 0.0.0.0 or * means exposed.
On Windows dev machines, run Get-MpPreference | Select-Object -ExpandProperty ExclusionPath and look for unexpected exclusions for temp or project folders.
Search proxy, firewall and EDR logs for POST /open-url from non-local addresses and for cmd.exe spawning encoded PowerShell from a node process.
Look for connections to the VulnCheck indicators 65.109.182.231, 223.6.249.141, 134.209.69.155, 8.218.43.248 and 47.86.33.195.

What happened#

On November 3, 2025, JFrog, acting as CNA, published CVE-2025-11953 in @react-native-community/cli-server-api, the package that powers the Metro development server started by npx react-native start. The CVE record scores it CVSS 3.1 9.8. JFrog's write-up, by Or Peles, followed on November 4.

The bug is a single endpoint. Metro's /open-url handler took the url field from a POST body and passed it straight to the open npm package. On Windows, open runs cmd /c start, so the "URL" can be a full shell command. On macOS and Linux an attacker can launch executables but has limited control over arguments. Metro also listens on all interfaces by default, even though it prints "localhost" at startup. Anyone who can reach port 8081 needs no login.

The fix, stricter URL validation, shipped in 20.0.0. The maintainers backported it to 19.1.2, 18.0.1 and 17.0.1 on November 5. A follow-up pull request then showed a Windows bypass using a pipe character (https://evil.com?|calc.exe). A sturdier sanitizer (PR #2758) shipped in 20.1.1 on January 28, 2026. The older backport lines did not get it.

On February 3, 2026, VulnCheck reported exploitation, which it nicknamed Metro4Shell, first seen on its canary network on December 21, 2025, and again on January 4 and 21. Attackers POSTed base64 PowerShell to /open-url. The script added Microsoft Defender exclusions, pulled a UPX-packed Rust binary over raw TCP, and ran it. The same servers also hosted a Linux build. CISA added the CVE to KEV on February 5, with a February 26 deadline.

Who is affected#

The CVE and GHSA-399j-vxmf-hjvr cover versions 4.8.0 up to 20.0.0. The two sides disagree on scope. JFrog says lines before 17 can still launch existing executables without arguments. A maintainer says a protocol check added in CLI v9 limited older lines, and that a 2025 refactor removed it. JFrog puts full command execution on Windows at 17.0.0 through 20.0.0-alpha.2, and the maintainers backported the fix to the 17, 18 and 19 lines. JFrog says Expo is not affected.

Do you really need to act?#

Metro is a developer tool, so this is not a production-server bug. The machines that matter are wherever Metro runs on a reachable address: a Windows laptop on office or hotel Wi-Fi, a cloud dev VM or remote workstation with a public IP, or a CI or end-to-end test runner that starts Metro. Those machines hold source code, signing keys and cloud credentials. VulnCheck's honeypots show that internet-facing instances are being found and attacked. Hence check exposure: upgrade, bind to localhost, and confirm no instance is exposed.

What to do now#

Run npm ls @react-native-community/cli-server-api in each project and npm ls -g @react-native-community/cli-server-api on build hosts.
Upgrade within your React Native line: 20.1.1 or later where possible, otherwise 19.1.2 (RN 0.81), 18.0.1 (RN 0.80) or 17.0.1.
Bind Metro to loopback: npx react-native start --host 127.0.0.1, and put the flag in your package.json scripts.
Block TCP 8081 from untrusted networks on dev VMs and CI runners.

How to tell if you were hit#

Check what Metro binds to: lsof -nP -iTCP:8081 -sTCP:LISTEN, or netstat -ano | findstr :8081 on Windows.
On Windows, run Get-MpPreference | Select-Object -ExpandProperty ExclusionPath and investigate unexpected temp or project-folder exclusions.
Hunt in EDR for node spawning cmd.exe and encoded PowerShell, and for traffic to the IPs VulnCheck lists.

Timeline#

Aug 11, 2025 — CLI 20.0.0 with the first fix is published to npm.
Nov 3, 2025 — CVE and GitHub advisory published; JFrog write-up follows Nov 4.
Nov 5, 2025 — Backports 19.1.2, 18.0.1 and 17.0.1 released.
Dec 21, 2025 — First exploitation seen by VulnCheck.
Jan 28, 2026 — CLI 20.1.1 hardens the fix.
Feb 5, 2026 — CISA adds the CVE to KEV.

Vulnerability records

CVE-2025-11953 · KEV 2026-02-05 · The Metro Development Server, which is opened by the React Native Community CLI, binds to external interfaces by default.

Sources

Original sources first: vendor and project advisories, CVE and government records, the discoverers’ write-ups. Every claim above links to one of these. See how the Security Desk works.