Critical React Native Vulnerability Actively Exploited in the Wild
Critical React Native Vulnerability Actively Exploited in (TL-2026-0057), also tracked as React Native Metro Server Vuln, is a critical-severity software vulnerability scored CVSS 9.1, first published 2026-02-03. It has no confirmed attribution, affects Meta/Facebook React Native, references 1 CVE (CVE-2025-11953), maps to 35 MITRE ATT&CK techniques (T1005, T1016, T1027), and is covered by 21 detection rules and 54 indicators of compromise.
Key facts for TL-2026-0057
- Threat ID
- TL-2026-0057
- Also known as
- React Native Metro Server Vuln
- Severity
- CRITICAL
- CVSS
- 9.1 (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N)
- Status
- PATCHED
- Category
- VULNERABILITY
- First published
- 2026-02-03
- Last reviewed
- 2026-02-03
- Attribution confidence
- NONE
- Motivation
- FINANCIAL
- Target sectors
- Technology, Software Development, Mobile Development, Information Technology
- Target regions
- Global
- Detection rules
- 21
- Indicators of compromise
- 54
CVE-2025-11953 — Critical OS command injection in React Native Community CLI's Metro Development Server /open-url endpoint (CVSS 9.8). Unauthenticated network attackers send POST requests to execute arbitrary OS commands via the unsafe open() NPM function. Server binds 0.0.0.0 by default despite displaying 'localhost' — exposing developer machines to network/internet attacks. 2M+ weekly NPM downloads. Active exploitation confirmed since December 21, 2025. Multi-stage PowerShell loaders delivering Rust-based payloads with Defender evasion. CISA KEV added February 5, 2026.
How Critical React Native Vulnerability Actively Exploited in works
CVE-2025-11953 is a critical (CVSS 9.8) OS command injection vulnerability in the @react-native-community/cli-server-api NPM package, versions 4.8.0 through 20.0.0-alpha.2. The Metro Development Server, used during React Native app development, exposes an /open-url HTTP endpoint that accepts POST requests with a JSON body containing a 'url' field. This user-supplied value is passed directly to the open() function from the 'open' NPM package without any sanitization.
On Windows, open() ultimately executes 'cmd /c start "" /b <user_input>', enabling full arbitrary OS command execution with attacker-controlled arguments. On macOS/Linux, open()/xdg-open are used without a shell, limiting exploitation to executable invocation with constrained parameter control — though full RCE may be achievable with further research via URI scheme handlers or file:// paths.
Critically, a second vulnerability in @react-native/community-cli-plugin causes the Metro server to bind to all network interfaces (0.0.0.0 and [::]) by default, despite displaying a misleading 'Starting dev server on http://localhost:8081' message. The runServer.js code sets hostname to 'localhost' for display purposes but passes the undefined args.host value to Metro.runServer(), which Node.js interprets as 'listen on all interfaces'. This transforms a local development vulnerability into a network-exploitable critical RCE.
The vulnerability was discovered by JFrog Security Research and responsibly disclosed. Meta's security team handled remediation via commit 15089907d (PR #2697), adding URL validation requiring http:// or https:// protocols. Fixed in @react-native-community/cli-server-api version 20.0.0.
VulnCheck observed active exploitation beginning December 21, 2025, with continued attacks on January 4 and January 21, 2026. Attackers deliver multi-stage PowerShell loaders via the /open-url endpoint that: (1) add Windows Defender exclusion paths, (2) establish raw TCP connections to attacker infrastructure, (3) download UPX-packed Rust-based binaries, and (4) execute the payload with encrypted arguments. Both Windows and Linux payloads observed. CISA added to KEV on February 5, 2026 with remediation deadline February 26, 2026.
Impact scope: any React Native project initialized with @react-native-community/cli versions 4.8.0-20.0.0-alpha.2 running Metro via npm start, npx react-native start, or similar commands. Projects using Expo framework with non-Metro servers are NOT vulnerable. ~2 million weekly NPM downloads of the affected package. Internet-facing Metro servers discovered via Censys/Fofa/ZoomEye scanning.
MITRE ATT&CK techniques used in TL-2026-0057
collection
T1005 Data from Local System; T1213 Data from Information Repositories
discovery
T1016 System Network Configuration Discovery; T1046 Network Service Discovery; T1057 Process Discovery; T1082 System Information Discovery; T1083 File and Directory Discovery; T1518 Software Discovery
defense-evasion
T1027 Obfuscated Files or Information; T1036 Masquerading; T1070 Indicator Removal; T1140 Deobfuscate/Decode Files or Information
exfiltration
T1041 Exfiltration Over C2 Channel
execution
T1053 Scheduled Task/Job; T1059 Command and Scripting Interpreter; T1204 User Execution; T1559 Inter-Process Communication
command-and-control
T1071 Application Layer Protocol; T1095 Non-Application Layer Protocol; T1105 Ingress Tool Transfer; T1571 Non-Standard Port; T1573 Encrypted Channel
persistence
T1133 External Remote Services; T1547 Boot or Logon Autostart Execution
initial-access
T1190 Exploit Public-Facing Application
lateral-movement
T1210 Exploitation of Remote Services
impact
T1485 Data Destruction; T1496 Resource Hijacking
credential-access
resource-development
T1583 Acquire Infrastructure; T1587 Develop Capabilities; T1588 Obtain Capabilities
reconnaissance
T1595 Active Scanning; T1596 Search Open Technical Databases
defense-impairment
Affected products and versions in Critical React Native Vulnerability Actively Exploited in
- Meta/Facebook — React Native
Vulnerable versions: Unpatched versions
Fixed in: Check vendor advisory
Remediation for Critical React Native Vulnerability Actively Exploited in
Patches
- [object Object]
Immediate actions
- Audit all React Native applications for vulnerable versions
- Apply vendor patches immediately
- Implement runtime application self-protection (RASP)
- Monitor for anomalous native bridge activity
Workarounds
- Enable additional runtime integrity checks
- Implement obfuscation for sensitive code paths
Longer-term hardening
- Implement mobile application security testing in CI/CD
- Deploy mobile threat defense (MTD) solutions
- Enable code signing and integrity verification
- Consider certificate pinning and anti-tampering controls
CVEs associated with Critical React Native Vulnerability Actively Exploited in
Weaknesses (CWE) in Critical React Native Vulnerability Actively Exploited in
CWE-94, CWE-502
Timeline of Critical React Native Vulnerability Actively Exploited in
Showing the 20 most recent tracked events.
- The /open-url endpoint in @react-native-community/cli-server-api passes unsanitized user input to the open() NPM package. Combined with the Metro server binding to 0.0.0.0 (all interfaces), this creates a remotely exploitable OS command injection. Vulnerable since version 4.8.0 (2019). Source: JFrog root cause analysis
- From version 17.0.0 onwards, the vulnerability escalates from executable invocation to full arbitrary OS command execution on Windows. Earlier versions (4.8.0-16.x) limited to running executables already on disk without arguments.
- JFrog Security Research team discovers CVE-2025-11953 in @react-native-community/cli-server-api — critical CVSS 9.8 OS command injection via /open-url endpoint. Also identifies secondary vulnerability: Metro binds 0.0.0.0 despite displaying localhost. Source: JFrog blog.
- CVE-2025-11953 assigned and published. NVD entry created with CWE-78 (OS Command Injection). JFrog publishes detailed root cause analysis blog post.
- Meta security team releases fix in commit 15089907d (PR #2697): URL validation requiring http:// or https:// protocol. Fixed in @react-native-community/cli-server-api version 20.0.0. Source: GitHub.
- JFrog Security Research discovers CVE-2025-11953 and discloses to Meta. React Native maintainer Szymon Rybczak acknowledges on X. Fix committed as 15089907d1f1 in @react-native-community/cli. Source: https://jfrog.com/blog/cve-2025-11953-critical-react-native-community-cli-vulnerability/
- CVE-2025-11953 published on NVD. CVSS 9.8 Critical. CWE-78 OS Command Injection. Affected: @react-native-community/cli-server-api 4.8.0 to 20.0.0-alpha.2. Source: https://nvd.nist.gov/vuln/detail/CVE-2025-11953
- JFrog publishes comprehensive root cause analysis including code walkthrough, exploitation details for Windows/macOS/Linux, and mitigation guidance. Source: https://jfrog.com/blog/cve-2025-11953-critical-react-native-community-cli-vulnerability/
- VulnCheck Canary network records first exploitation of CVE-2025-11953 in the wild. Multi-stage PowerShell loader delivered via /open-url endpoint. Payload hosted at 8.218.43.248:60124. Source: VulnCheck Metro4Shell blog.
- VulnCheck Canary network records first exploitation in the wild. Multi-stage PowerShell payload: base64 decode → Defender exclusion → TCP to 8.218.43.248:60124 → download Rust binary → execute. Source: https://www.vulncheck.com/blog/metro4shell_eitw
- VulnCheck observes continued exploitation with identical payloads, indicating operational rather than experimental use. Same C2 infrastructure. Source: VulnCheck Metro4Shell blog
- Third wave of exploitation observed by VulnCheck. Same operational patterns indicating continued use rather than proof-of-concept testing. Exploitation sources: 65.109.182.231, 223.6.249.141, 134.209.69.155. Source: VulnCheck.
- Third wave of exploitation observed by VulnCheck. EPSS still assigns low probability (0.00405) despite confirmed in-the-wild exploitation. Source: VulnCheck Metro4Shell blog
- VulnCheck publishes 'Metro4Shell' blog documenting active exploitation since December 2025. Notes EPSS still assigns low probability (0.00405) despite confirmed ITW exploitation — highlighting gap between observed exploitation and risk scoring. Source: VulnCheck.
- VulnCheck publishes 'Metro4Shell: Exploitation of React Native's Metro Server in the Wild' documenting exploitation timeline, C2 infrastructure, payload analysis, and attack source IPs. Source: https://www.vulncheck.com/blog/metro4shell_eitw
- CISA adds CVE-2025-11953 to Known Exploited Vulnerabilities catalog. Required action: apply mitigations or discontinue use. Remediation deadline: February 26, 2026. Source: CISA KEV.
- CISA adds CVE-2025-11953 to Known Exploited Vulnerabilities catalog. Remediation deadline: 2026-02-26. Source: https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2025-11953
- JFrog updates blog post clarifying difference in impact between versions <17.0.0 (executable invocation only) and >=17.0.0 (full OS command execution on Windows). Source: JFrog.
- JFrog updates blog post to clarify impact differences between pre-17.0.0 and 17.0.0+ versions. Pre-17: executable execution only (no args). 17.0.0+: full OS command execution with controlled arguments (Windows). Source: JFrog blog update
- As of 2026-05-29, CVE-2025-11953 (Metro4Shell) is patched: the React Native CLI fix shipped in cli-server-api v20.0.0 (hardened v20.1.1), and the CISA KEV remediation deadline of 2026-02-26 has elapsed. VulnCheck-confirmed in-the-wild waves (Dec 2025, Jan 4 and 21 2026) show no new exploitation since late January; the unattributed financial actor persists only against unpatched, internet-exposed Metro servers.
Sources cited for Critical React Native Vulnerability Actively Exploited in
- JFrog: CVE-2025-11953 Root Cause Analysis
- VulnCheck: Metro4Shell Exploitation in the Wild
- NVD: CVE-2025-11953
- CISA KEV: CVE-2025-11953
- GitHub Patch: commit 15089907d1f1
- BleepingComputer: React Native Metro Bug Exploitation
- VirusTotal: UPX-packed Rust payload
- VirusTotal: Unpacked Rust payload
- NPM: @react-native-community/cli-server-api
- GitHub Release v20.1.1 — Additional RCE prevention via URL sanitization
Threats related to Critical React Native Vulnerability Actively Exploited in
Detection coverage for TL-2026-0057
As of 2026-02-03, Threadlinqs Intelligence publishes 21 detection rule(s) for TL-2026-0057 across Splunk SPL, Microsoft KQL and Sigma, covering 54 indicator(s) of compromise. The whole corpus is readable without an account; a free account unlocks full detection query text in Splunk SPL, Microsoft KQL and Sigma; paid tiers add raw indicator values, correlation and the MCP server. Threadlinqs MCP server · View plans.