VYPR
Get started
← All advisories
Critical severityCISA KEVNVD Advisory· Published Nov 3, 2025· Updated Feb 26, 2026

Command injection in React Native Community CLI allows remote attackers to perform remote code execution by sending HTTP requests

CVE-2025-11953

Description

The Metro Development Server, which is opened by the React Native Community CLI, binds to external interfaces by default. The server exposes an endpoint that is vulnerable to OS command injection. This allows unauthenticated network attackers to send a POST request to the server and run arbitrary executables. On Windows, the attackers can also execute arbitrary shell commands with fully controlled arguments.

Affected packages

Versions sourced from the GitHub Security Advisory.

PackageAffected versionsPatched versions
@react-native-community/clinpm
>= 20.0.0-alpha.0, < 20.0.020.0.0
@react-native-community/clinpm
>= 19.0.0-alpha.0, < 19.1.219.1.2
@react-native-community/clinpm
>= 18.0.0, < 18.0.118.0.1
@react-native-community/cli-server-apinpm
>= 20.0.0-alpha.0, < 20.0.020.0.0
@react-native-community/cli-server-apinpm
>= 19.0.0-alpha.0, < 19.1.219.1.2
@react-native-community/cli-server-apinpm
>= 18.0.0, < 18.0.118.0.1

Affected products

1
  • /v5
    Range: 4.8.0

Patches

4
9e1fa8cc633e

fix: Add stricter URL validation to openURLMiddleware (#2697)

https://github.com/react-native-community/cliAlex HuntAug 4, 2025via ghsa
commit
1 file changed · +13 −0
  • packages/cli-server-api/src/openURLMiddleware.ts+13 −0 modified
    @@ -31,6 +31,19 @@ async function openURLMiddleware(
 
     const {url} = req.body as {url: string};
 
+    try {
+      const parsedUrl = new URL(url);
+      if (parsedUrl.protocol !== 'http:' && parsedUrl.protocol !== 'https:') {
+        res.writeHead(400);
+        res.end('Invalid URL protocol');
+        return;
+      }
+    } catch (error) {
+      res.writeHead(400);
+      res.end('Invalid URL format');
+      return;
+    }
+
     await open(url);
 
     res.writeHead(200);
5a792169d988

fix: Add stricter URL validation to openURLMiddleware (#2697)

https://github.com/react-native-community/cliAlex HuntAug 4, 2025via ghsa
commit
1 file changed · +13 −0
  • packages/cli-server-api/src/openURLMiddleware.ts+13 −0 modified
    @@ -31,6 +31,19 @@ async function openURLMiddleware(
 
     const {url} = req.body as {url: string};
 
+    try {
+      const parsedUrl = new URL(url);
+      if (parsedUrl.protocol !== 'http:' && parsedUrl.protocol !== 'https:') {
+        res.writeHead(400);
+        res.end('Invalid URL protocol');
+        return;
+      }
+    } catch (error) {
+      res.writeHead(400);
+      res.end('Invalid URL format');
+      return;
+    }
+
     await open(url);
 
     res.writeHead(200);
15089907d1f1

fix: Add stricter URL validation to openURLMiddleware (#2697)

https://github.com/react-native-community/cliAlex HuntAug 4, 2025via ghsa
commit
1 file changed · +13 −0
  • packages/cli-server-api/src/openURLMiddleware.ts+13 −0 modified
    @@ -31,6 +31,19 @@ async function openURLMiddleware(
 
     const {url} = req.body as {url: string};
 
+    try {
+      const parsedUrl = new URL(url);
+      if (parsedUrl.protocol !== 'http:' && parsedUrl.protocol !== 'https:') {
+        res.writeHead(400);
+        res.end('Invalid URL protocol');
+        return;
+      }
+    } catch (error) {
+      res.writeHead(400);
+      res.end('Invalid URL format');
+      return;
+    }
+
     await open(url);
 
     res.writeHead(200);
a8293dc29425

fix: Add stricter URL validation to openURLMiddleware (#2697)

https://github.com/react-native-community/cliAlex HuntAug 4, 2025via ghsa
commit
1 file changed · +13 −0
  • packages/cli-server-api/src/openURLMiddleware.ts+13 −0 modified
    @@ -31,6 +31,19 @@ async function openURLMiddleware(
 
     const {url} = req.body as {url: string};
 
+    try {
+      const parsedUrl = new URL(url);
+      if (parsedUrl.protocol !== 'http:' && parsedUrl.protocol !== 'https:') {
+        res.writeHead(400);
+        res.end('Invalid URL protocol');
+        return;
+      }
+    } catch (error) {
+      res.writeHead(400);
+      res.end('Invalid URL format');
+      return;
+    }
+
     await open(url);
 
     res.writeHead(200);

Vulnerability mechanics

Generated by null/stub on May 9, 2026. Inputs: CWE entries + fix-commit diffs from this CVE's patches. Citations validated against bundle.

References

15

News mentions

0

No linked articles in our index yet.