React Native CLI Vulnerability: Patch CVE‑2025‑11953

The React Native CLI vulnerability developers are talking about this week—tracked as CVE‑2025‑11953 with a CVSS score of 9.8—allows unauthenticated remote code execution via the Metro development server. The flaw affects @react-native-community/cli and its cli-server-api package up to pre‑20.0.0 builds, with fixes available in 20.0.0 and later. If your Metro server is reachable on your network (port 8081 by default), you need to act. (jfrog.com)

What actually happened—and why this bug is dangerous

Metro exposes an HTTP endpoint (e.g., /open-url) that the CLI passes directly into the OS via the open() call. Because Metro binds to all interfaces by default, a malicious POST request can reach your workstation from the network and trigger arbitrary execution. On Windows, researchers demonstrated full command execution with attacker‑controlled arguments; on macOS and Linux, arbitrary executables can be launched with more limited parameter control. That combination—no auth, network‑reachable, dev machines with source and creds—turns a “dev‑only” bug into real business risk. (jfrog.com)

The fix tightened URL validation in the middleware and shipped in the React Native Community CLI 20.0.0 release on October 2, 2025, which included the “stricter URL validation” patch. The GitHub Advisory Database then recorded CVE‑2025‑11953 on November 3, 2025. (github.com)

Is my project affected?

If your toolchain runs Metro via React Native CLI and you’re on @react-native-community/cli versions 4.8.0 through 20.0.0‑alpha.2 (or the matching @react-native-community/cli-server-api range), you’re in scope. Projects using frameworks that don’t rely on Metro as their dev server are typically out of scope, but verify. (jfrog.com)

Quick exposure test (60 seconds)

Run these on a dev box while the app is in npm start or npx react-native start mode:

• Detect the package in your project: npm ls @react-native-community/cli-server-api (or yarn why / pnpm why). Also check global: npm ls -g @react-native-community/cli-server-api. You want 20.0.0+. (jfrog.com)
• Check whether Metro is listening on all interfaces:
  • macOS/Linux: lsof -iTCP:8081 -sTCP:LISTEN or ss -ltnp | grep 8081
  • Windows: netstat -ano | findstr 8081
  If it’s bound to 0.0.0.0 or your LAN IP, it’s reachable from the network.

The fastest safe patch path

Here’s the thing: you don’t need a sweeping migration to mitigate CVE‑2025‑11953. The patch is already published. Fix your CLI packages first, then tighten your network posture.

1) Upgrade the CLI packages

In your app directory:

• npm i -D @react-native-community/cli@^20.0.0 @react-native-community/cli-server-api@^20.0.0
• or with Yarn: yarn add -D @react-native-community/cli@^20.0.0 @react-native-community/cli-server-api@^20.0.0
• or with pnpm: pnpm add -D @react-native-community/cli@^20.0.0 @react-native-community/cli-server-api@^20.0.0

Confirm the fix landed in v20.0.0 and was released October 2, 2025. If you maintain pinned lockfiles, refresh them and ensure no workspace pulls in the vulnerable pre‑20.0.0 server API. (github.com)

2) Until all boxes are patched, bind Metro to localhost

Force local binding during development sessions:

npx react-native start --host 127.0.0.1
# or CLI alias
npx @react-native-community/cli start --host 127.0.0.1

This reduces the attack surface by preventing remote hosts on your LAN from reaching the Metro endpoint while you finish rolling out the update. Researchers explicitly recommend local binding as an interim mitigation. (research.jfrog.com)

3) Block port 8081 inbound

Even after upgrading, keep a default‑deny stance on dev networks:

• macOS: add a PF or app firewall rule to drop inbound 8081 from non‑loopback.
• Windows: Windows Defender Firewall inbound rule to block TCP 8081 except Local Subnet or VPN ranges you trust.
• Corporate: segment dev subnets; require VPN to reach emulators on physical devices.

People also ask

Does this React Native CLI vulnerability affect production apps?

Not directly. Metro is a development server; you don’t ship it to users. The risk is to developer workstations and CI agents where Metro might run—systems that often hold SSH keys, signing certificates, and proprietary source. That makes the blast radius business‑critical despite being “dev‑only.” (jfrog.com)

How do I know if my Metro server is exposed?

If lsof, ss, or netstat shows Metro bound to 0.0.0.0:8081 (or a non‑loopback address) and your firewall allows inbound traffic, it’s reachable. From another machine on the same network, a simple curl http://your-ip:8081/open-url returning a response means the endpoint is exposed. The disclosed exploit targets this endpoint. Don’t do this on unpatched systems outside a lab. (jfrog.com)

Which versions are fixed?

Updates that include the stricter URL validation shipped with CLI 20.0.0 and newer, with the specific patch visible in commit 1508990. If you see any alpha builds below 20.0.0 in your tree, upgrade. The GitHub Advisory entry was published November 3, 2025. (github.com)

The anatomy of CVE‑2025‑11953

Let’s get practical about where it went wrong:

• Unsafe parameter handling: The /open-url endpoint accepted untrusted input and forwarded it to the OS via open() without sufficient validation, enabling command or binary execution depending on OS. (jfrog.com)
• Risky default binding: Metro bound to 0.0.0.0 in common setups, exposing the endpoint to the local network. A console message that suggests “localhost” can be misleading; always verify the actual bind address. (infoworld.com)
• High‑value hosts: Dev boxes often hold access tokens, keystores, and infrastructure context, so RCE here is a big deal for lateral movement and supply chain threats.

A 10‑minute remediation checklist for teams

Drop this into your team’s Slack and sprint board:

1. Inventory all workstations and CI agents that build React Native apps.
2. Patch CLI packages to 20.0.0+ and refresh lockfiles; confirm with npm ls on both project and global scopes. (jfrog.com)
3. Bind local with --host 127.0.0.1 for in‑progress work; require VPN for physical device testing that needs LAN access. (research.jfrog.com)
4. Firewall inbound TCP/8081 by default; allow only explicit ranges.
5. Scan SBOMs and lockfiles for vulnerable versions in monorepos and templates.
6. Monitor for suspicious POSTs to /open-url in dev logs while you roll out patches. (jfrog.com)
7. Educate developers on running Metro only when needed and closing it after use.

Data and dates you can take to leadership

Here are the details decision‑makers will ask for:

• CVE and severity: CVE‑2025‑11953, CVSS 9.8 (critical). (nvd.nist.gov)
• Disclosure timeline: Fix released in CLI 20.0.0 on October 2, 2025; advisory published November 3, 2025. (github.com)
• Impact scope: Affects 4.8.0 through 20.0.0‑alpha.2; fixed in 20.0.0+. (jfrog.com)
• Exploit conditions: Network‑reachable Metro dev server (8081) with vulnerable CLI; PoC paths target /open-url. (jfrog.com)

Windows specifics you shouldn’t ignore

Windows is the easiest path to full RCE because the shell invocation allows attackers to control arguments. If your mobile team prefers Windows for Android work, prioritize those upgrades and rules. Consider WDAC or AppLocker to constrain untrusted binaries on dev images while you patch. (jfrog.com)

Will upgrading break my project?

CLI 20.0.0 didn’t introduce breaking API changes for typical app scaffolds; the release notes primarily list the URL validation fix and minor quality updates. If you’re far behind on React Native, budget some time to align your toolchain, but most teams can patch the CLI without touching app code. Always run your local builds and E2Es after the bump. (github.com)

Hardening dev environments—turn lessons into policy

Zooming out, this incident highlights a familiar pattern: developer tooling often trusts local networks and user input more than it should. Make the following part of your baseline:

• Local‑only by default: Prefer loopback binds in dev servers and enable remote access only during on‑device testing.
• Network segmentation: Keep dev VLANs isolated; require VPN and device enrollment to cross segments.
• Secure builds: Treat build steps that call external services as egress‑sensitive. If you deploy on Vercel, route builds through static IPs to maintain tight allowlists—here’s our guide on using Vercel Static IPs for builds.
• Automate dependency hygiene: Dependabot/ Renovate for JS, SBOMs in CI, and policy checks before merge.

Related reading from our team

If you’re planning a broader React Native update, our take on the latest architecture will help you sequence the work: read React Native 0.82’s New Arch: cross‑platform tactics. Securing agents and automation around your repos? See how to run multi‑agent dev safely and where guardrails matter most. For platform teams rethinking front‑end composition and cost controls, our notes on Vercel’s Fluid Compute are relevant to shaping safe, efficient pipelines.

FAQ‑style quick hits

Can I just firewall 8081 and skip the upgrade?

No. Defense‑in‑depth beats “either/or.” Patch first, then lock down the port. Attackers evolve, developers forget to toggle flags, and laptops move between networks.

Are there confirmed exploits in the wild?

As of November 6, 2025, multiple analyses and advisories explain trivial exploitability and provide PoCs; public reporting has not confirmed widespread in‑the‑wild compromise yet. Don’t wait for one. (techradar.com)

Does Expo affect this?

Teams using frameworks that don’t rely on Metro as their dev server are typically not affected. Still, check your dependency tree to be sure. (jfrog.com)

What to do next (developers and leads)

• Upgrade @react-native-community/cli and cli-server-api to 20.0.0+ across all workstations and CI agents today. (jfrog.com)
• Bind Metro to 127.0.0.1 by default; require a VPN for on‑device testing that needs LAN access. (research.jfrog.com)
• Block inbound TCP/8081 except trusted ranges; verify with lsof/ss/netstat.
• Audit logs for suspicious POSTs to /open-url while rolling out the patch. (jfrog.com)
• Add a “dev server hardening” section to your engineering handbook and CI templates; enforce with preflight scripts.
• If you want a second set of eyes on your patch plan or a broader security tune‑up, our team can help—see services and contact us.

Bottom line

CVE‑2025‑11953 isn’t theoretical. It’s a straightforward path to code execution on the very machines that ship your mobile apps. The React Native team shipped a fix; now it’s on us to roll it out, verify the network posture, and keep our dev boxes from becoming the attacker’s easiest foothold. If you need help pressure‑testing your plan or coaching the rollout, start here: our what we do page spells out the ways we harden toolchains without slowing teams down.