{"id":"react-native-cli-metro4shell-attacks-feb-2026","category":"patch","status":"closed","title":"React Native Community CLI Metro4Shell flaw CVE-2025-11953 exploited to deliver malware","tldr":"Attackers exploited React Native Community CLI development servers reachable over a network. Developers should update affected CLI and server-api packages to 18.0.1, 19.1.2 or 20.0.0 or later in the compatible branch, and restrict server access.","summary":"Metro4Shell, CVE-2025-11953, affects the development server started by React Native Community CLI, a tool used to build mobile apps. Someone who can reach a vulnerable server can run programs without logging in; Windows also permits arbitrary shell commands. This directly affects developers' computers and development infrastructure. BleepingComputer and The Hacker News reported repeated malware-delivery attacks first observed on 21 December 2025, and CISA listed the flaw as exploited on 5 February 2026. Affected-version claims differ: BleepingComputer described versions 4.8.0 through 20.0.0-alpha.2, while maintainers disputed that broad range. The current GitHub advisory lists affected releases in the 18.x, 19.x and prerelease 20.x branches, with fixes in 18.0.1, 19.1.2 and 20.0.0 respectively. Maintainers said all affected branches had fixes by 7 November 2025. June's 20.2.0 release restored browser links while retaining the protection. The reports do not establish how many real machines were compromised.","action":"Nothing for you to do unless you or someone managing your computers develops React Native apps. Ask that developer or IT team to update both @react-native-community/cli and @react-native-community/cli-server-api to at least 18.0.1, 19.1.2 or 20.0.0 in the project's compatible branch, restrict development-server access, and check previously exposed machines for compromise.","product":"React Native Community CLI and its Metro development-server API","audience":"work","severity":"critical","patch":"patched","exploited":true,"cves":["CVE-2025-11953"],"tags":["react-native","metro4shell","developer-tools","command-injection","actively-exploited"],"affected":["@react-native-community/cli >=18.0.0, <18.0.1","@react-native-community/cli >=19.0.0-alpha.0, <19.1.2","@react-native-community/cli >=20.0.0-alpha.0, <20.0.0","@react-native-community/cli-server-api >=18.0.0, <18.0.1","@react-native-community/cli-server-api >=19.0.0-alpha.0, <19.1.2","@react-native-community/cli-server-api >=20.0.0-alpha.0, <20.0.0"],"fixed":["@react-native-community/cli 18.0.1","@react-native-community/cli 19.1.2","@react-native-community/cli 20.0.0","@react-native-community/cli-server-api 18.0.1","@react-native-community/cli-server-api 19.1.2","@react-native-community/cli-server-api 20.0.0"],"matches":[],"sources":[{"kind":"advisory","title":"React Native Community CLI v20.0.0 release notes","url":"https://github.com/react-native-community/cli/releases/tag/v20.0.0","by":"React Native Community","date":"2025-10-02"},{"kind":"post","title":"Maintainer clarification and backport announcement in issue #2733","url":"https://github.com/react-native-community/cli/issues/2733","by":"React Native Community","date":"2025-11-07"},{"kind":"advisory","title":"@react-native-community/cli has arbitrary OS command injection","url":"https://github.com/advisories/GHSA-399j-vxmf-hjvr","by":"GitHub","date":"2026-02-05"},{"kind":"news","title":"Hackers exploit critical React Native Metro bug to breach dev systems","url":"https://www.bleepingcomputer.com/news/security/hackers-exploit-critical-react-native-metro-bug-to-breach-dev-systems/","by":"BleepingComputer","date":"2026-02-03"},{"kind":"news","title":"Hackers Exploit Metro4Shell RCE Flaw in React Native CLI npm Package","url":"https://thehackernews.com/2026/02/hackers-exploit-metro4shell-rce-flaw-in.html","by":"The Hacker News","date":"2026-02-06"},{"kind":"post","title":"React Native Community CLI v20.2.0 release notes","url":"https://github.com/react-native-community/cli/releases/tag/v20.2.0","by":"React Native Community","date":"2026-06-25"}],"started":"2026-02-05","closed":"2026-06-25","created":"2026-11-03T22:30:48.676Z","updated":"2026-11-03T22:30:48.676Z","cve_notes":[{"cve":"CVE-2025-11953","name":"Command injection in React Native CLI development server","what":"Inadequate input validation in React Native Community CLI's development-server API lets an unauthenticated network attacker run programs on the host, including arbitrary shell commands on Windows.","severity":"critical","cvss":9.8}],"timeline":[{"at":"2026-06-25","added":"2026-11-03T22:23:31.291Z","kind":"other","text":"Maintainers released CLI 20.2.0. Its release notes describe restoring browser-link functionality while retaining protection against CVE-2025-11953.","url":"https://github.com/react-native-community/cli/releases/tag/v20.2.0","by":"React Native Community","patch":null},{"at":"2026-02-05","added":"2026-11-03T22:23:31.291Z","kind":"cisa-added","text":"CISA added CVE-2025-11953 to its Known Exploited Vulnerabilities catalogue. US federal civilian agencies were given until 26 February to apply the fixes.","url":"https://thehackernews.com/2026/02/hackers-exploit-metro4shell-rce-flaw-in.html","by":"The Hacker News","patch":null},{"at":"2026-02-03","added":"2026-11-03T22:23:31.291Z","kind":"wider-attacks","text":"Public reports described repeated exploitation of the flaw, now called Metro4Shell, to deliver malware. The Hacker News reported that the observed Windows attacks attempted to weaken Microsoft Defender protection and install a Rust-based payload.","url":"https://thehackernews.com/2026/02/hackers-exploit-metro4shell-rce-flaw-in.html","by":"The Hacker News","patch":null},{"at":"2025-12-21","added":"2026-11-03T22:23:31.291Z","kind":"other","text":"VulnCheck first observed exploitation on its decoy-server network, according to BleepingComputer's subsequent report. Further activity delivering the same payloads was observed on 4 and 21 January 2026.","url":"https://www.bleepingcomputer.com/news/security/hackers-exploit-critical-react-native-metro-bug-to-breach-dev-systems/","by":"BleepingComputer","patch":null},{"at":"2025-11-07","added":"2026-11-03T22:23:31.291Z","kind":"new-fix","text":"Maintainers announced backported fixes in 18.0.1 and 19.1.2 and said all affected versions had fixes. They disputed the original broad affected-version claims and advised developers to use the CLI branch compatible with their React Native project.","url":"https://github.com/react-native-community/cli/issues/2733","by":"React Native Community","patch":"patched"},{"at":"2025-11-03","added":"2026-11-03T22:23:31.291Z","kind":"disclosed","text":"CVE-2025-11953 was publicly recorded as a critical command-injection flaw in React Native Community CLI. An attacker able to reach its development server could run programs without logging in.","url":"https://github.com/advisories/GHSA-399j-vxmf-hjvr","by":"GitHub","patch":null},{"at":"2025-10-02","added":"2026-11-03T22:23:31.291Z","kind":"new-fix","text":"React Native Community CLI 20.0.0 shipped stricter URL validation. The current advisory identifies it as the first fixed 20.x release; fixes for the affected 18.x and 19.x branches followed.","url":"https://github.com/react-native-community/cli/releases/tag/v20.0.0","by":"React Native Community","patch":"partial"}],"url":"https://hard.fyi/live/react-native-cli-metro4shell-attacks-feb-2026/","json":"https://hard.fyi/api/live?id=react-native-cli-metro4shell-attacks-feb-2026"}