CVE-2025-11953

# CVE-2025-11953: React Native Community CLI Command Injection **What it is:** React Native Community CLI's Metro Development Server exposes an endpoint that accepts POST requests without proper input validation, allowing attackers to inject and execute arbitrary OS commands on the host system. **Impact:** An unauthenticated attacker with network access to a development server can execute arbitrary binaries and shell commands with the privileges of the Node.js process. On Windows systems, attackers gain full control over command arguments, increasing exploitation flexibility. **What to do:** Immediately disable or restrict network access to Metro Development Server instances (typically port 8081). Update React Native Community CLI to a patched version when available. Do not expose development servers to untrusted networks. Review logs for POST requests to the vulnerable endpoint if your organization uses React Native CLI in development environments.