React Native Metro Server Faces Critical RCE

A critical vulnerability tracked as CVE-2025-11953 exposes the React Native Metro server, used within the React Native Community CLI, to remote code execution. With a CVSS severity score of 9.8, the flaw allows attackers to execute arbitrary system commands through an operating system command injection issue in the Metro development server. The vulnerability poses a major threat to developers running the Metro server in development environments without proper security configurations.

Security researchers flagged this issue as urgent due to the ease of exploitation and potential impact. Although the vulnerability operates only in development mode, the risk of unauthorized code execution remains significant.

Another similarly named vulnerability, CVE-2025-11593, also appeared in recent threat reports, though its details differ. Developers relying on the React Native Metro server should update their tools immediately to minimize exposure to attacks.

To read the full report and access technical details, visit the original article below:

CVE-2025-11953: Critical RCE in React Native CLI’s Metro Dev Server