Exploited vulnerabilitiesBriefPublic record
React Native CLI / Metro dev-server RCE (CVE-2025-11953)
The Metro dev server bound to 0.0.0.0, and the `/open-url` endpoint allowed OS command injection.
- Disclosed
What happened
- The Metro dev server bound to 0.0.0.0, and the `/open-url` endpoint allowed OS command injection. Fixed: @react-native-community/cli-server-api 20.0.0.
- Exploitation reported by VulnCheck in Dec 2025. KEV status not confirmed this session.
Live scores
Live scores
CVE-2025-11953- EPSS
- 0.940
very likely to be attacked soon - VEDAS
- 0.988
strong exploit evidence - On CISA KEV
- Yes, since 2026-02-05
Thin horizontal line: the “likely” (EPSS 0.10) or “strong” (VEDAS 0.90) threshold. Shaded “no data” areas are periods when cve-scores did not publish. The vertical line is the day CISA added it to its exploited list.
Sources
- https://jfrog.com/blog/cve-2025-11953-critical-react-native-community-cli-vulnerability/
- https://nvd.nist.gov/vuln/detail/CVE-2025-11953
This is a brief: a short, sourced summary from our incident tracking. Full advisories add commands to check whether you are affected.