Critical RCE Bug in Leading React Native NPM Module Could Allow Full System Compromise

A severe security vulnerability has been discovered in a widely used React Native development package, potentially exposing millions of developers to remote attacks.Security researchers from JFrog recently uncovered CVE-2025-11953, a critical remote code execution flaw affecting the @react-native-community/cli NPM package, which receives approximately two million weekly downloads.The vulnerability carries a maximum CVSS score of 9.8, indicating its severity and ease of exploitation by unauthenticated attackers.CVE IDAffected ProductAffected VersionsCVSS ScoreVulnerability to 20.0.0-alpha.29.8 (Critical)Remote Code Execution (RCE)The flaw enables remote attackers to execute arbitrary operating system commands on machines running React Native’s development server without requiring authentication or user interaction.This represents a significant threat to developers working on React Native mobile applications, as exploitation could lead to complete system compromise.The vulnerability exists in versions 4.8.0 through 20.0.0-alpha.2 of the @react-native-community/cli-server-api package and has been patched in version 20.0.0.Overview of the VulnerabilityThe security flaw originates from unsafe handling of user input in the Metro development server’s /open-url endpoint.When developers run common commands such as npm start or npx react-native start to launch their development environment, the server processes POST requests containing unsanitized data that gets passed directly to the dangerous open() function from the open NPM package.This function executes system-level commands without proper validation, creating a pathway for attackers to inject malicious commands.On Windows systems, researchers demonstrated complete arbitrary command execution with full parameter control.A new pwned.txt file created in C:\temp as a result of our cmd.exe /c command – proving the arbitrary code execution succeeded.The vulnerability allows attackers to execute shell commands by crafting malicious requests that bypass basic sanitization attempts.While macOS and Linux systems show slightly more restricted exploitation paths due to different code execution mechanisms, researchers believe arbitrary command execution remains achievable with additional research on these platforms.The vulnerability and displays its details along with Data Trace EvidenceCompounding the problem, JFrog discovered a second vulnerability in React Native’s core codebase that causes the development server to bind to all network interfaces rather than localhost only, despite displaying messages indicating localhost-only operation.This misconfiguration transforms what might have been a local-only security issue into a remotely exploitable critical vulnerability, as the development endpoints become accessible to network attackers.Developers who initiated React Native projects using vulnerable versions of @react-native-community/cli and run the Metro development server through standard commands are at risk.However, developers using frameworks like Expo that employ different development servers are typically not affected.To verify if your project contains the vulnerable package, navigate to your project folder and run npm list @react-native-community/cli-server-api.The package may also be globally installed on your system, which can be checked using npm list -g @react-native-community/cli-server-api.Meta’s security team has responded promptly to the disclosure by releasing a patch in version 20.0.0 of the affected package.Developers should immediately update @react-native-community/cli-server-api to version 20.0.0 or higher in all their React Native projects.For situations where upgrading proves difficult, developers can mitigate the risk by explicitly binding the development server to the localhost interface using the –host 127.0.0.1 flag when starting the server, such as npx react-native start –host 127.0.0.1.This discovery highlights how even straightforward code execution flaws continue appearing in production software, particularly when dangerous functions reside in third-party dependencies.The vulnerability serves as a reminder that secure coding practices and automated security scanning remain essential for preventing easily exploitable flaws before they reach production environments.Follow us on Google News, LinkedIn, and X to Get Instant Updates and Set GBH as a Preferred Source in Google.

Based on reporting by GBHackers.