# Critical React Native Vulnerability Actively Exploited in the Wild

> CVE-2025-11953 — Critical OS command injection in React Native Community CLI's Metro Development Server /open-url endpoint (CVSS 9.8). Unauthenticated network attackers send POST requests to execute arbitrary OS commands via the unsafe open() NPM function. Server binds 0.0.0.0 by default despite displaying 'localhost' — exposing developer machines to network/internet attacks. 2M+ weekly NPM downloads. Active exploitation confirmed since December 21, 2025. Multi-stage PowerShell loaders delivering Rust-based payloads with Defender evasion. CISA KEV added February 5, 2026.

- **Published:** 2026-02-03T14:06:00Z
- **Last reviewed:** 2026-02-03T14:06:00Z
- **Canonical:** https://intel.threadlinqs.com/threat/TL-2026-0057
- **Card image:** https://intel.threadlinqs.com/og/threat/threat-intel-react-native-metro-rce-tl-2026-0057.webp?v=d15ac53a (Threadlinqs threat intel: CVE-2025-11953 React Native Metro RCE: Detection & IOCs (TL-2026-0057) — Critical severity, 54 IOCs, 21 detection rules.)
- **ID:** TL-2026-0057
- **Severity:** CRITICAL (CVSS 9.1)
- **Category:** VULNERABILITY
- **Status:** PATCHED
- **Detections:** 21 (1 shown free below) · **IOCs:** 54 (3 shown free below)
- **CVEs:** CVE-2025-11953

## Description

CVE-2025-11953 is a critical (CVSS 9.8) OS command injection vulnerability in the @react-native-community/cli-server-api NPM package, versions 4.8.0 through 20.0.0-alpha.2. The Metro Development Server, used during React Native app development, exposes an /open-url HTTP endpoint that accepts POST requests with a JSON body containing a 'url' field. This user-supplied value is passed directly to the open() function from the 'open' NPM package without any sanitization.

On Windows, open() ultimately executes 'cmd /c start "" /b <user_input>', enabling full arbitrary OS command execution with attacker-controlled arguments. On macOS/Linux, open()/xdg-open are used without a shell, limiting exploitation to executable invocation with constrained parameter control — though full RCE may be achievable with further research via URI scheme handlers or file:// paths.

Critically, a second vulnerability in @react-native/community-cli-plugin causes the Metro server to bind to all network interfaces (0.0.0.0 and [::]) by default, despite displaying a misleading 'Starting dev server on http://localhost:8081' message. The runServer.js code sets hostname to 'localhost' for display purposes but passes the undefined args.host value to Metro.runServer(), which Node.js interprets as 'listen on all interfaces'. This transforms a local development vulnerability into a network-exploitable critical RCE.

The vulnerability was discovered by JFrog Security Research and responsibly disclosed. Meta's security team handled remediation via commit 15089907d (PR #2697), adding URL validation requiring http:// or https:// protocols. Fixed in @react-native-community/cli-server-api version 20.0.0.

VulnCheck observed active exploitation beginning December 21, 2025, with continued attacks on January 4 and January 21, 2026. Attackers deliver multi-stage PowerShell loaders via the /open-url endpoint that: (1) add Windows Defender exclusion paths, (2) establish raw TCP connections to attacker infrastructure, (3) download UPX-packed Rust-based binaries, and (4) execute the payload with encrypted arguments. Both Windows and Linux payloads observed. CISA added to KEV on February 5, 2026 with remediation deadline February 26, 2026.

Impact scope: any React Native project initialized with @react-native-community/cli versions 4.8.0-20.0.0-alpha.2 running Metro via npm start, npx react-native start, or similar commands. Projects using Expo framework with non-Metro servers are NOT vulnerable. ~2 million weekly NPM downloads of the affected package. Internet-facing Metro servers discovered via Censys/Fofa/ZoomEye scanning.

## MITRE ATT&CK

- T1190 Exploit Public-Facing Application
- T1059 Command and Scripting Interpreter
- T1685 Disable or Modify Tools
- T1027 Obfuscated Files or Information
- T1140 Deobfuscate/Decode Files or Information
- T1071 Application Layer Protocol
- T1571 Non-Standard Port
- T1105 Ingress Tool Transfer
- T1082 System Information Discovery
- T1595 Active Scanning
- T1587 Develop Capabilities
- T1583 Acquire Infrastructure
- T1005 Data from Local System
- T1496 Resource Hijacking
- T1204 User Execution
- T1053 Scheduled Task/Job
- T1547 Boot or Logon Autostart Execution
- T1036 Masquerading
- T1070 Indicator Removal
- T1016 System Network Configuration Discovery
- T1518 Software Discovery
- T1046 Network Service Discovery
- T1095 Non-Application Layer Protocol
- T1573 Encrypted Channel
- T1210 Exploitation of Remote Services
- T1485 Data Destruction
- T1588 Obtain Capabilities
- T1596 Search Open Technical Databases
- T1133 External Remote Services
- T1559 Inter-Process Communication
- T1552 Unsecured Credentials
- T1083 File and Directory Discovery
- T1057 Process Discovery
- T1213 Data from Information Repositories
- T1041 Exfiltration Over C2 Channel

## Free detection (Splunk SPL, Microsoft KQL)

**React Native Security Protection Bypass** (`TL-2026-0057-DET-001`)

Detects attempts to disable or bypass security protections in React Native applications

- **Languages:** Splunk SPL, Microsoft KQL
- **Data sources:** mobile_edr, app_logs
- **Severity:** critical
- **Confidence:** high

### Splunk SPL

```spl
index=mobile sourcetype=mobile_edr OR sourcetype=app_logs
| where match(app_framework, "(?i)react.?native")
| where match(event_type, "(?i)(security_bypass|protection_disabled|jailbreak_detect_bypass)")
  OR match(function_call, "(?i)(disable.*security|bypass.*check|remove.*protection)")
| stats count values(event_type) as events by device_id, app_name, user
| eval alert_severity="CRITICAL"
| eval alert_reason="React Native security protection bypass detected - potential exploitation"
```

### Microsoft KQL

```kql
// React Native Security Protection Bypass
IntuneDevices
| where TimeGenerated > ago(24h)
| where AppName has "react" or DeviceDetail has "ReactNative"
| where EventType has_any ("SecurityBypass", "ProtectionDisabled", "JailbreakBypass")
| summarize EventCount=count(), Events=make_set(EventType) by DeviceId, AppName, UserPrincipalName
| where EventCount >= 1
```

**Known false positives:**

- Security testing tools
- Development/debugging

**Tuning notes:** Whitelist developer devices; focus on production app deployments

### 20 more detection rules (Splunk SPL, Microsoft KQL, Sigma), unlock with TL Creds

- Metro4Shell — HTTP POST to [indicator] with Command Execution (locked: unlock with TL Creds)
- Windows Defender Exclusion Added by Development Tool Child Process (locked: unlock with TL Creds)
- Outbound Connection to Metro4Shell C2 Infrastructure (locked: unlock with TL Creds)
- Metro Dev Server Exposed — Inbound Connection to Port [indicator] (locked: unlock with TL Creds)
- Curl Download from Metro4Shell C2 — Known Infrastructure (locked: unlock with TL Creds)
- UPX-Packed Binary Execution from Temp Directory — Developer Machine (locked: unlock with TL Creds)
- Metro4Shell CVE-2025-11953 — [indicator] Exploitation Attempt (locked: unlock with TL Creds)
- Rust UPX Binary in Temp Directory — Metro4Shell Payload (locked: unlock with TL Creds)
- Developer Machine C2 Connection — Port [indicator] (locked: unlock with TL Creds)
- Suspicious React Native Bridge Activity (locked: unlock with TL Creds)
- React Native App Tampering Detection (locked: unlock with TL Creds)
- Metro4Shell Exploitation Chain — Node Process Spawning cmd.exe or PowerShell (locked: unlock with TL Creds)
- Metro4Shell Payload Download and Execution from %TEMP% (locked: unlock with TL Creds)
- Exposed Metro Development Server — External Inbound on Port [indicator] (locked: unlock with TL Creds)
- Metro4Shell PowerShell Encoded Command from Node.js Process (locked: unlock with TL Creds)
- Metro4Shell C2 Network Indicators — IP, Port, and User-Agent (locked: unlock with TL Creds)
- Metro4Shell Payload Execution — UPX Binary and Defender Exclusion Chain (locked: unlock with TL Creds)
- Metro4Shell [indicator] Exploitation via HTTP POST (locked: unlock with TL Creds)
- Windows Defender Exclusion Added by Development Tool Process (locked: unlock with TL Creds)
- Metro4Shell C2 Communication — Known Infrastructure and Payload Download (locked: unlock with TL Creds)

Sign up free to unlock the detection rules: https://threadlinqs.com/?modal=signup

## Sample indicators (3 of 54)

Defanged, TLP:CLEAR.

- IP address: `8.218.43[.]248`
- File hash: `d8337df3aff749250557bf11daf069eb404cce0e6f4f91c6bd6d3f78aed6e9d6`
- IP address: `47.86.33[.]195`

Full set of 54 indicators unlocks with TL Creds: https://threadlinqs.com/tl-creds

## Sources

- [JFrog: CVE-2025-11953 Root Cause Analysis](https://jfrog.com/blog/cve-2025-11953-critical-react-native-community-cli-vulnerability/)
- [VulnCheck: Metro4Shell Exploitation in the Wild](https://www.vulncheck.com/blog/metro4shell_eitw)
- [NVD: CVE-2025-11953](https://nvd.nist.gov/vuln/detail/CVE-2025-11953)
- [CISA KEV: CVE-2025-11953](https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2025-11953)
- [GitHub Patch: commit 15089907d1f1](https://github.com/react-native-community/cli/commit/15089907d1f1301b22c72d7f68846a2ef20df547)
- [BleepingComputer: React Native Metro Bug Exploitation](https://www.bleepingcomputer.com/news/security/hackers-exploit-critical-react-native-metro-bug-to-breach-dev-systems/)
- [VirusTotal: UPX-packed Rust payload](https://www.virustotal.com/gui/file/d8337df3aff749250557bf11daf069eb404cce0e6f4f91c6bd6d3f78aed6e9d6)
- [VirusTotal: Unpacked Rust payload](https://www.virustotal.com/gui/file/7ecbb0cc88dfa5f187c209a28bd25e8e2d5113bb898a91ae273bca5983130886)
- [NPM: @react-native-community/cli-server-api](https://www.npmjs.com/package/@react-native-community/cli-server-api)
- [GitHub Release v20.1.1 — Additional RCE prevention via URL sanitization](https://github.com/react-native-community/cli/releases/tag/v20.1.1)

## Full data

The other 20 detection rules (Splunk SPL / Microsoft KQL / Sigma) unlock with TL Creds; a free account includes daily creds: https://threadlinqs.com/?modal=signup
Indicator values unlock with TL Creds, at a lower price on Red and Purple; AI agents can query rules and IOCs through the Threadlinqs MCP server (Purple): https://intel.threadlinqs.com/mcp

Canonical: https://intel.threadlinqs.com/threat/TL-2026-0057