Skip to content

2026-02-05 — React Native Community CLI: Metro dev server command injection (CVE-2025-11953) (CISA KEV)

October 1 follow-up: react-dev-utils openBrowser command injection on macOS (GHSA-g9g6-gvq9-j4vp / CVE-2026-14802, react-dev-utils ≤5.0.1, i.e. Create React App ≤5.0.1, unfixed — upstream unresponsive, exploit public). Same family, opposite leg: instead of the dev server executing requests, the dev toolchain's browser-launch helper (startBrowserProcess in openBrowser.js) interpolates browser/URL values into shell-backed execution on macOS, so attacker-influenced URL/BROWSER-style input crosses into OS command execution. Operator axes: (1) dev-tooling browser-launch helpers are command-execution sinks, not navigation helpers — enumerate every place a repo-local config, env var (BROWSER), or server-suggested URL reaches open/osascript/x-www-browser argument construction; on macOS the osascript -e 'open location "..."'-shaped quoting is the classic break point. (2) Unfixed + exploit-public + informed-vendor-silent means the durable fix is removal/upgrade (CRA is EOL) — for assessments it means every legacy CRA dev box is a standing local-primitive candidate once you have any file/env write or a user who visits an attacker-influenced dev URL. (3) Test pattern in an owned lab: set BROWSER to a marker command with argument separators, trigger the dev-server "open in browser" path, and record whether the marker executes via shell vs execve argument array; keep proofs to inert touch /tmp/…-class markers on owned macOS fixtures. Report as dev-machine-to-host execution only when the input source is actually attacker-reachable (shared repo env files, malicious deps calling the opener, or a dev server reflecting URLs to the opener).

CISA added CVE-2025-11953 to the Known Exploited Vulnerabilities catalog.

Summary

React Native Community CLI includes an OS command injection issue that can allow unauthenticated network attackers to send requests to the Metro Development Server and execute commands.

This is especially dangerous when dev servers are:

  • accidentally exposed to other networks (--host / 0.0.0.0)
  • reachable from untrusted segments (Wi-Fi, shared office networks)

Triage

  • Identify any running Metro dev servers exposed beyond localhost.
  • Check for:
  • react-native start --host 0.0.0.0
  • reverse proxies / port forwards exposing Metro

Mitigation

  • Patch / update @react-native-community/cli per upstream guidance.
  • Treat Metro as localhost-only:
  • bind to 127.0.0.1
  • firewall block inbound access
  • For shared dev environments: isolate with VPN + auth (or don’t expose at all).

Detection / hunt

  • Search dev-host logs for unexpected POSTs to Metro endpoints.
  • Network IDS: alert on inbound access to typical Metro ports from non-dev hosts.