Hackers Exploiting React Native’s Metro Server in the Wild to Attack Developers
A significant remote code execution vulnerability in React Native's Metro Development Server is being actively exploited by threat actors. This vulnerability, identified as CVE-2025-11953 , enables the deployment of advanced malware payloads across…
A significant remote code execution vulnerability in React Native's Metro Development Server is being actively exploited by threat actors. This vulnerability, identified as CVE-2025-11953 , enables the deployment of advanced malware payloads across Windows and Linux systems.
First detected by VulnCheck's Canary honeypot network on December 21, 2025, the vulnerability, termed "Metro4Shell," has been subjected to ongoing exploitation into January 2026. Despite its severity, CVE-2025-11953 has not gained significant attention in public security discussions.
CVE-2025-11953 affects the Metro Development Server included with the @react-native-community/cli npm package, a crucial tool for React Native development. The vulnerability arises from the server's default configuration, which binds to external network interfaces and exposes an /open-url endpoint vulnerable to OS command injection.
Research by JFrog revealed that this endpoint allows unauthenticated remote attackers to execute arbitrary shell commands by passing user-controlled input directly to the unsafe open() function from the open npm package. On Windows, attackers can execute commands with any arguments, while on macOS and Linux, they can launch executable files.
Despite a CVSS score of 9.8, indicating critical severity, the Exploit Prediction Scoring System (EPSS) assigns a low probability of exploitation at 0.00405, contrasting with observed exploitation activity.
VulnCheck's analysis indicates that the exploitation attempts were operational rather than experimental, with consistent deployment over several weeks. The attacks used a sophisticated multi-stage PowerShell-based loader delivered through cmd.exe. The initial PowerShell payload was base64-encoded to avoid detection.
The decoded script executes a sequence to establish persistence and evade security controls, including adding Microsoft Defender exclusion paths and establishing a TCP connection to attacker-controlled infrastructure for further payload retrieval.
The downloaded executable, a UPX-packed Rust-based malware, incorporates anti-analysis techniques. VulnCheck observed similar attack infrastructure hosting "linux" payloads, indicating cross-platform capabilities.
A significant remote code execution vulnerability in React Native's Metro Development Server is being actively exploited by threat actors.
This campaign highlights a temporal disconnect between exploitation and public awareness, as exploitation was detected in December 2025, but public discourse remained limited as of January 2026.
Organizations utilizing React Native development environments should immediately upgrade to @react-native-community/cli version 20.0.0 or later to address the vulnerability. The vulnerability impacts versions 4.8.0 through 20.0.0-alpha.2.
Development infrastructure should be treated as a production-grade attack surface. Metro Development Servers should not be exposed to untrusted networks, and network segmentation should isolate development environments from internet-accessible interfaces.
IP Address Role Source
65.109.182.231 Exploitation source VulnCheck Canary
223.6.249.141 Exploitation source VulnCheck Canary
134.209.69.155 Exploitation source VulnCheck Canary
8.218.43.248 Payload host (Windows) VulnCheck Canary
47.86.33.195 Payload host (Windows/Linux) VulnCheck Canary
SHA-256 Hash Description Source
d8337df3aff749250557bf11daf069eb404cce0e6f4f91c6bd6d3f78aed6e9d6 UPX-packed Windows payload VulnCheck Analysis
7ecbb0cc88dfa5f187c209a28bd25e8e2d5113bb898a91ae273bca5983130886 Unpacked Windows payload (Rust binary) VulnCheck Analysis
Based on reporting by Cyber Security News.