Critical React Native Vulnerability Actively Exploited in the Wild

Key facts for React Native Metro RCE

Detection coverage for React Native Metro RCE

As of 2026-02-03, Threadlinqs Intelligence publishes 21 detection rule(s) for TL-2026-0057 across Splunk SPL, Microsoft KQL and Sigma, covering 54 indicator(s) of compromise. The whole corpus is readable without an account. Every threat comes with one complete detection in Splunk SPL, Microsoft KQL and Sigma, free for everyone; a free account adds daily TL Creds to unlock the rest. Paid plans add a larger daily allowance, correlation and the MCP server. Threadlinqs MCP server · View plans.

Free detection: React Native Security Protection Bypass

Detects attempts to disable or bypass security protections in React Native applications

• Languages: Splunk SPL, Microsoft KQL
• Data sources: mobile_edr, app_logs
• Severity: critical
• Confidence: high

Splunk SPL

index=mobile sourcetype=mobile_edr OR sourcetype=app_logs
| where match(app_framework, "(?i)react.?native")
| where match(event_type, "(?i)(security_bypass|protection_disabled|jailbreak_detect_bypass)")
  OR match(function_call, "(?i)(disable.*security|bypass.*check|remove.*protection)")
| stats count values(event_type) as events by device_id, app_name, user
| eval alert_severity="CRITICAL"
| eval alert_reason="React Native security protection bypass detected - potential exploitation"

Microsoft KQL

// React Native Security Protection Bypass
IntuneDevices
| where TimeGenerated > ago(24h)
| where AppName has "react" or DeviceDetail has "ReactNative"
| where EventType has_any ("SecurityBypass", "ProtectionDisabled", "JailbreakBypass")
| summarize EventCount=count(), Events=make_set(EventType) by DeviceId, AppName, UserPrincipalName
| where EventCount >= 1

Known false positives:

• Security testing tools
• Development/debugging

Tuning notes: Whitelist developer devices; focus on production app deployments

• 🔒 Metro4Shell — HTTP POST to [indicator] with Command Execution · unlock with TL Creds
• 🔒 Windows Defender Exclusion Added by Development Tool Child Process · unlock with TL Creds
• 🔒 Outbound Connection to Metro4Shell C2 Infrastructure · unlock with TL Creds
• 🔒 Metro Dev Server Exposed — Inbound Connection to Port [indicator] · unlock with TL Creds
• 🔒 Curl Download from Metro4Shell C2 — Known Infrastructure · unlock with TL Creds
• 🔒 UPX-Packed Binary Execution from Temp Directory — Developer Machine · unlock with TL Creds
• 🔒 Metro4Shell CVE-2025-11953 — [indicator] Exploitation Attempt · unlock with TL Creds
• 🔒 Rust UPX Binary in Temp Directory — Metro4Shell Payload · unlock with TL Creds
• 🔒 Developer Machine C2 Connection — Port [indicator] · unlock with TL Creds
• 🔒 Suspicious React Native Bridge Activity · unlock with TL Creds
• 🔒 React Native App Tampering Detection · unlock with TL Creds
• 🔒 Metro4Shell Exploitation Chain — Node Process Spawning cmd.exe or PowerShell · unlock with TL Creds
• 🔒 Metro4Shell Payload Download and Execution from %TEMP% · unlock with TL Creds
• 🔒 Exposed Metro Development Server — External Inbound on Port [indicator] · unlock with TL Creds
• 🔒 Metro4Shell PowerShell Encoded Command from Node.js Process · unlock with TL Creds
• 🔒 Metro4Shell C2 Network Indicators — IP, Port, and User-Agent · unlock with TL Creds
• 🔒 Metro4Shell Payload Execution — UPX Binary and Defender Exclusion Chain · unlock with TL Creds
• 🔒 Metro4Shell [indicator] Exploitation via HTTP POST · unlock with TL Creds
• 🔒 Windows Defender Exclusion Added by Development Tool Process · unlock with TL Creds
• 🔒 Metro4Shell C2 Communication — Known Infrastructure and Payload Download · unlock with TL Creds

Indicators of compromise for React Native Metro RCE

As of 2026-02-03, Threadlinqs Intelligence tracks 54 indicators of compromise for TL-2026-0057.

Sample indicators (3 of 54)

• IP address: 8.218.43[.]248
• File hash: d8337df3aff749250557bf11daf069eb404cce0e6f4f91c6bd6d3f78aed6e9d6
• IP address: 47.86.33[.]195

Defanged, TLP:CLEAR. Full set of 54 indicators: unlock with TL Creds.

How React Native Metro RCE works

2M+ weekly NPM downloads. Active exploitation confirmed since December 21, 2025. Multi-stage PowerShell loaders delivering Rust-based payloads with Defender evasion. CISA KEV added February 5, 2026.

CVE-2025-11953 is a critical (CVSS 9.8) OS command injection vulnerability in the @react-native-community/cli-server-api NPM package, versions 4.8.0 through 20.0.0-alpha.2. The Metro Development Server, used during React Native app development, exposes an /open-url HTTP endpoint that accepts POST requests with a JSON body containing a 'url' field. This user-supplied value is passed directly to the open() function from the 'open' NPM package without any sanitization.

On Windows, open() ultimately executes 'cmd /c start "" /b <user_input>', enabling full arbitrary OS command execution with attacker-controlled arguments. On macOS/Linux, open()/xdg-open are used without a shell, limiting exploitation to executable invocation with constrained parameter control — though full RCE may be achievable with further research via URI scheme handlers or file:// paths.

Critically, a second vulnerability in @react-native/community-cli-plugin causes the Metro server to bind to all network interfaces (0.0.0.0 and [::]) by default, despite displaying a misleading 'Starting dev server on http://localhost:8081' message. The runServer.js code sets hostname to 'localhost' for display purposes but passes the undefined args.host value to Metro.runServer(), which Node.js interprets as 'listen on all interfaces'. This transforms a local development vulnerability into a network-exploitable critical RCE.

The vulnerability was discovered by JFrog Security Research and responsibly disclosed. Meta's security team handled remediation via commit 15089907d (PR #2697), adding URL validation requiring http:// or https:// protocols. Fixed in @react-native-community/cli-server-api version 20.0.0.

VulnCheck observed active exploitation beginning December 21, 2025, with continued attacks on January 4 and January 21, 2026. Attackers deliver multi-stage PowerShell loaders via the /open-url endpoint that: (1) add Windows Defender exclusion paths, (2) establish raw TCP connections to attacker infrastructure, (3) download UPX-packed Rust-based binaries, and (4) execute the payload with encrypted arguments. Both Windows and Linux payloads observed. CISA added to KEV on February 5, 2026 with remediation deadline February 26, 2026.

Impact scope: any React Native project initialized with @react-native-community/cli versions 4.8.0-20.0.0-alpha.2 running Metro via npm start, npx react-native start, or similar commands. Projects using Expo framework with non-Metro servers are NOT vulnerable. ~2 million weekly NPM downloads of the affected package. Internet-facing Metro servers discovered via Censys/Fofa/ZoomEye scanning.

MITRE ATT&CK techniques by tactic:

collection

T1005 Data from Local System; T1213 Data from Information Repositories

discovery

T1016 System Network Configuration Discovery; T1046 Network Service Discovery; T1057 Process Discovery; T1082 System Information Discovery; T1083 File and Directory Discovery; T1518 Software Discovery

defense-evasion

T1027 Obfuscated Files or Information; T1036 Masquerading; T1070 Indicator Removal; T1140 Deobfuscate/Decode Files or Information

exfiltration

T1041 Exfiltration Over C2 Channel

execution

T1053 Scheduled Task/Job; T1059 Command and Scripting Interpreter; T1204 User Execution; T1559 Inter-Process Communication

command-and-control

T1071 Application Layer Protocol; T1095 Non-Application Layer Protocol; T1105 Ingress Tool Transfer; T1571 Non-Standard Port; T1573 Encrypted Channel

persistence

T1133 External Remote Services; T1547 Boot or Logon Autostart Execution

initial-access

T1190 Exploit Public-Facing Application

lateral-movement

T1210 Exploitation of Remote Services

impact

T1485 Data Destruction; T1496 Resource Hijacking

credential-access

T1552 Unsecured Credentials

resource-development

T1583 Acquire Infrastructure; T1587 Develop Capabilities; T1588 Obtain Capabilities

reconnaissance

T1595 Active Scanning; T1596 Search Open Technical Databases

defense-impairment

T1685 Disable or Modify Tools

Remediation for React Native Metro RCE

Patches

• [object Object]

Immediate actions

• Audit all React Native applications for vulnerable versions
• Apply vendor patches immediately
• Implement runtime application self-protection (RASP)
• Monitor for anomalous native bridge activity

Workarounds

• Enable additional runtime integrity checks
• Implement obfuscation for sensitive code paths

Longer-term hardening

• Implement mobile application security testing in CI/CD
• Deploy mobile threat defense (MTD) solutions
• Enable code signing and integrity verification
• Consider certificate pinning and anti-tampering controls

Affected and fixed versions

• Meta/Facebook — React Native
  Vulnerable versions: Unpatched versions
  Fixed in: Check vendor advisory

Timeline of React Native Metro RCE

Showing the 20 most recent tracked events.

• 2025-06-01 The locked-ioc-50 endpoint in @react-native-community/cli-server-api passes unsanitized user input to the open() NPM package. Combined with the Metro server binding to 0.0.0.0 (all interfaces), this creates a remotely exploitable OS command injection. Vulnerable since version 4.8.0 (2019). Source: JFrog root cause analysis
• 2025-10-01 From version 17.0.0 onwards, the vulnerability escalates from executable invocation to full arbitrary OS command execution on Windows. Earlier versions (4.8.0-16.x) limited to running executables already on disk without arguments.
• 2025-11-01 JFrog Security Research team discovers CVE-2025-11953 in @react-native-community/cli-server-api — critical CVSS 9.8 OS command injection via locked-ioc-50 endpoint. Also identifies secondary vulnerability: Metro binds 0.0.0.0 despite displaying localhost. Source: JFrog blog.
• 2025-12-01 CVE-2025-11953 assigned and published. NVD entry created with CWE-78 (OS Command Injection). JFrog publishes detailed root cause analysis blog post.
• 2025-12-01 Meta security team releases fix in commit 15089907d (PR #2697): URL validation requiring http:// or https:// protocol. Fixed in @react-native-community/cli-server-api version 20.0.0. Source: GitHub.
• 2025-12-01 JFrog Security Research discovers CVE-2025-11953 and discloses to Meta. React Native maintainer Szymon Rybczak acknowledges on X. Fix committed as 15089907d1f1 in @react-native-community/cli. Source: https://jfrog.com/blog/cve-2025-11953-critical-react-native-community-cli-vulnerability/
• 2025-12-10 CVE-2025-11953 published on NVD. CVSS 9.8 Critical. CWE-78 OS Command Injection. Affected: @react-native-community/cli-server-api 4.8.0 to 20.0.0-alpha.2. Source: https://nvd.nist.gov/vuln/detail/CVE-2025-11953
• 2025-12-15 JFrog publishes comprehensive root cause analysis including code walkthrough, exploitation details for Windows/macOS/Linux, and mitigation guidance. Source: https://jfrog.com/blog/cve-2025-11953-critical-react-native-community-cli-vulnerability/
• 2025-12-21 VulnCheck Canary network records first exploitation of CVE-2025-11953 in the wild. Multi-stage PowerShell loader delivered via locked-ioc-50 endpoint. Payload hosted at locked-ioc-40. Source: VulnCheck Metro4Shell blog.
• 2025-12-21 VulnCheck Canary network records first exploitation in the wild. Multi-stage PowerShell payload: base64 decode → Defender exclusion → TCP to locked-ioc-40 → download Rust binary → execute. Source: https://www.vulncheck.com/blog/metro4shell_eitw
• 2026-01-04 VulnCheck observes continued exploitation with identical payloads, indicating operational rather than experimental use. Same C2 infrastructure. Source: VulnCheck Metro4Shell blog
• 2026-01-21 Third wave of exploitation observed by VulnCheck. Same operational patterns indicating continued use rather than proof-of-concept testing. Exploitation sources: locked-ioc-42, locked-ioc-45, locked-ioc-43. Source: VulnCheck.
• 2026-01-21 Third wave of exploitation observed by VulnCheck. EPSS still assigns low probability (0.00405) despite confirmed in-the-wild exploitation. Source: VulnCheck Metro4Shell blog
• 2026-01-28 VulnCheck publishes 'Metro4Shell' blog documenting active exploitation since December 2025. Notes EPSS still assigns low probability (0.00405) despite confirmed ITW exploitation — highlighting gap between observed exploitation and risk scoring. Source: VulnCheck.
• 2026-01-28 VulnCheck publishes 'Metro4Shell: Exploitation of React Native's Metro Server in the Wild' documenting exploitation timeline, C2 infrastructure, payload analysis, and attack source IPs. Source: https://www.vulncheck.com/blog/metro4shell_eitw
• 2026-02-05 CISA adds CVE-2025-11953 to Known Exploited Vulnerabilities catalog. Required action: apply mitigations or discontinue use. Remediation deadline: February 26, 2026. Source: CISA KEV.
• 2026-02-05 CISA adds CVE-2025-11953 to Known Exploited Vulnerabilities catalog. Remediation deadline: 2026-02-26. Source: https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2025-11953
• 2026-02-09 JFrog updates blog post clarifying difference in impact between versions <17.0.0 (executable invocation only) and >=17.0.0 (full OS command execution on Windows). Source: JFrog.
• 2026-02-09 JFrog updates blog post to clarify impact differences between pre-17.0.0 and 17.0.0+ versions. Pre-17: executable execution only (no args). 17.0.0+: full OS command execution with controlled arguments (Windows). Source: JFrog blog update
• 2026-05-29 As of 2026-05-29, CVE-2025-11953 (Metro4Shell) is patched: the React Native CLI fix shipped in cli-server-api v20.0.0 (hardened v20.1.1), and the CISA KEV remediation deadline of 2026-02-26 has elapsed. VulnCheck-confirmed in-the-wild waves (Dec 2025, Jan 4 and 21 2026) show no new exploitation since late January; the unattributed financial actor persists only against unpatched, internet-exposed Metro servers.

Sources cited for React Native Metro RCE

• NVD: CVE-2025-11953 NVD (NIST) · Advisory · 2025-12-10
• CISA KEV: CVE-2025-11953 CISA · Government advisory · 2026-02-05
• NPM: @react-native-community/cli-server-api npmjs.com · Vendor report · 2025-12-01
• GitHub Release v20.1.1 — Additional RCE prevention via URL sanitization GitHub · Vendor report · 2026-01-15
• JFrog: CVE-2025-11953 Root Cause Analysis jfrog.com · Blog · 2025-12-15
• VulnCheck: Metro4Shell Exploitation in the Wild vulncheck.com · Blog · 2026-01-28
• BleepingComputer: React Native Metro Bug Exploitation BleepingComputer · News · 2026-01-30
• GitHub Patch: commit 15089907d1f1 GitHub · Other · 2025-12-01
• VirusTotal: UPX-packed Rust payload virustotal.com · Other · 2025-12-21
• VirusTotal: Unpacked Rust payload virustotal.com · Other · 2025-12-21

Threats related to React Native Metro RCE

• SolarWinds Web Help Desk Deserialization RCE - CISA KEV
• P2Pinfect Kubernetes Compromise — Exposed Redis Enables Persistent GKE Botnet Enrollment with Six-Month Dormancy (CVE-2022-0543, CVE-2025-11953, CVE-2025-49844)