CVE-2025-11953
Act now ● On CISA KEV — actively exploited
Actively exploited — on the CISA KEV list.
CVSS base
—
EPSS — probability of exploitation (30 days)
94.0%
99.8th percentile
CISA KEV
Listed
Added 2026-02-05 · patch by 2026-02-26
Weakness / dates
—
Published — · modified —
Timeline
- 2026-02-05 — Added to CISA KEV (actively exploited)
- 2026-02-26 — CISA patch-by deadline
Description
React Native Community CLI contains an OS command injection vulnerability which could allow unauthenticated network attackers to send POST requests to the Metro Development Server and run arbitrary executables via a vulnerable endpoint exposed by the server. On Windows, attackers can also execute arbitrary shell commands with fully controlled arguments.