NewsCompaniesFlawsGuides
Get the app
CriticalFixedBeing used in attacksClosedUpdated

React Native Community CLI Metro4Shell flaw CVE-2025-11953 exploited to deliver malware

Attackers exploited React Native Community CLI development servers reachable over a network. Developers should update affected CLI and server-api packages to 18.0.1, 19.1.2 or 20.0.0 or later in the compatible branch, and restrict server access.

What to do

Nothing for you to do unless you or someone managing your computers develops React Native apps. Ask that developer or IT team to update both @react-native-community/cli and @react-native-community/cli-server-api to at least 18.0.1, 19.1.2 or 20.0.0 in the project's compatible branch, restrict development-server access, and check previously exposed machines for compromise.

What’s happening

Metro4Shell, CVE-2025-11953, affects the development server started by React Native Community CLI, a tool used to build mobile apps. Someone who can reach a vulnerable server can run programs without logging in; Windows also permits arbitrary shell commands. This directly affects developers' computers and development infrastructure. BleepingComputer and The Hacker News reported repeated malware-delivery attacks first observed on 21 December 2025, and CISA listed the flaw as exploited on 5 February 2026. Affected-version claims differ: BleepingComputer described versions 4.8.0 through 20.0.0-alpha.2, while maintainers disputed that broad range. The current GitHub advisory lists affected releases in the 18.x, 19.x and prerelease 20.x branches, with fixes in 18.0.1, 19.1.2 and 20.0.0 respectively. Maintainers said all affected branches had fixes by 7 November 2025. June's 20.2.0 release restored browser links while retaining the protection. The reports do not establish how many real machines were compromised.

What
Flaw
Affects
React Native Community CLI and its Metro development-server API
Affected
@react-native-community/cli >=18.0.0, <18.0.1
@react-native-community/cli >=19.0.0-alpha.0, <19.1.2
@react-native-community/cli >=20.0.0-alpha.0, <20.0.0
@react-native-community/cli-server-api >=18.0.0, <18.0.1
@react-native-community/cli-server-api >=19.0.0-alpha.0, <19.1.2
@react-native-community/cli-server-api >=20.0.0-alpha.0, <20.0.0
Fixed in
@react-native-community/cli 18.0.1
@react-native-community/cli 19.1.2
@react-native-community/cli 20.0.0
@react-native-community/cli-server-api 18.0.1
@react-native-community/cli-server-api 19.1.2
@react-native-community/cli-server-api 20.0.0
CVE
CVE-2025-11953
Since
5 Feb 2026
Closed
25 June 2026

Timeline

  1. Update

    Maintainers released CLI 20.2.0. Its release notes describe restoring browser-link functionality while retaining protection against CVE-2025-11953.

  2. CISA added

    CISA added CVE-2025-11953 to its Known Exploited Vulnerabilities catalogue. US federal civilian agencies were given until 26 February to apply the fixes.

  3. Wider attacks

    Public reports described repeated exploitation of the flaw, now called Metro4Shell, to deliver malware. The Hacker News reported that the observed Windows attacks attempted to weaken Microsoft Defender protection and install a Rust-based payload.

  4. Update

    VulnCheck first observed exploitation on its decoy-server network, according to BleepingComputer's subsequent report. Further activity delivering the same payloads was observed on 4 and 21 January 2026.

  5. New fixFixed

    Maintainers announced backported fixes in 18.0.1 and 19.1.2 and said all affected versions had fixes. They disputed the original broad affected-version claims and advised developers to use the CLI branch compatible with their React Native project.

  6. Made public

    CVE-2025-11953 was publicly recorded as a critical command-injection flaw in React Native Community CLI. An attacker able to reach its development server could run programs without logging in.

  7. New fixPartly fixed

    React Native Community CLI 20.0.0 shipped stricter URL validation. The current advisory identifies it as the first fixed 20.x release; fixes for the affected 18.x and 19.x branches followed.

Sources

  1. React Native Community CLI v20.0.0 release notesReact Native Community · 2 Oct 2025
  2. Maintainer clarification and backport announcement in issue #2733React Native Community · 7 Nov 2025
  3. @react-native-community/cli has arbitrary OS command injectionGitHub · 5 Feb 2026
  4. Hackers exploit critical React Native Metro bug to breach dev systemsBleepingComputer · 3 Feb 2026
  5. Hackers Exploit Metro4Shell RCE Flaw in React Native CLI npm PackageThe Hacker News · 6 Feb 2026
  6. React Native Community CLI v20.2.0 release notesReact Native Community · 25 June 2026
HARD Live follows this until it’s over: each change is added to the timeline with its source. Everything live · Everything from February 2026 · JSON · RSS