OS Command Injection in React Native Community CLI (CVE‑2025‑11953) Enables Unauthenticated Remote Code Execution
What It Is — The React Native Community CLI contains an OS command‑injection flaw (CVE‑2025‑11953) that lets an unauthenticated network attacker send a crafted POST request to the Metro development server and cause the server to execute arbitrary operating‑system commands, including full Windows shell commands.
Exploitability — The vulnerable endpoint is exposed by default when the Metro server runs; no authentication is required. Public proof‑of‑concept code exists, indicating active exploitability. CVSS v3.1 base score 8.8 (High).
Affected Products — React Native Community CLI (all versions prior to the vendor’s 2025‑03‑15 patch) on Windows, macOS, and Linux.
Why It Matters for Trust & Control Assurance
- Demonstrates the need for continuous vulnerability monitoring of the software‑supply chain.
- Tests the control objective of secure configuration management and runtime protection, a pillar across NIST CSF, ISO 27001, and other frameworks.
- Provides a concrete audit‑ready evidence point: remediation of a known CVE must be captured and mapped to your control framework to maintain a defensible trust posture.
Recommended Actions
- Upgrade to the patched CLI version released 2025‑03‑15 or later.
- Restrict network access to the Metro server and enforce authentication or firewall rules.
- Integrate the CLI into automated SAST/SCA pipelines to surface future CVEs early.
- Enable detailed logging of Metro endpoint requests and monitor for anomalous activity.
Source: CISA KEV – CVE‑2025‑11953