Critical Flaw in Popular React Native NPM Package Exposes Developers to Attacks
Source SecurityWeek
Exploited in the wild · KEV due 26 Feb 2026 · public detection template (Nuclei) : apply the vendor's fix or mitigations to CLI now.
Data as of 5 Nov 2025, 12:14 UTC
- KEV deadline
- US federal agencies must patch by this date; a sensible deadline for everyone else.
Exploitation evidence
t = 0 is the CVE’s publication on cve.org
Disclosed: evidence found.
CVE published 3 Nov 2025
Detectable: evidence found.
nuclei template: React Native Community CLI - Unauthenticated OS Command Injection
Weaponised: no evidence on record.
No public exploit code indexed in Metasploit or Exploit-DB
Exploited in the wildExploited: evidence found.
Listed in CISA KEV 94 days after disclosure
Observed by OffSeq MirageSeen by Mirage: no evidence on record.
No attack traffic recorded by OffSeq Mirage sensors
Timeline
CVE ID reserved
by JFROG
, 14 days before disclosure
CVE published
on cve.org
, t = 0
In Threat Radar
record ingested
, 12 minutes after disclosure
Added to CISA KEV (opens in a new tab)
exploitation confirmed
, 94 days after disclosure
KEV remediation due
US federal deadline
, 115 days after disclosure
A missing step is not evidence of safety. Sources: cve.org (opens in a new tab), CISA KEV (opens in a new tab), the Metasploit, Exploit-DB and nuclei-templates index as of 2026-10-25.
What to do
Affected software
| Product | Affected | Fixed in |
|---|---|---|
npmmetropkg:npm/metroOther threats | Affected
| Fixed in– |
Check your own hosts for these packages with threat-finder (opens in a new tab), our free open-source scanner.
AI-suggested
Organizations should implement the following specific mitigation steps: 1) Monitor official channels for patches or updates to the affected React Native NPM package and apply them immediately upon release. 2) Conduct thorough audits of all NPM dependencies in development environments to identify and isolate vulnerable packages. 3) Employ strict access controls and least privilege principles on developer machines to limit the impact of potential code execution. 4) Use containerized or sandboxed development environments to contain any exploitation attempts. 5) Integrate automated dependency scanning tools into CI/CD pipelines to detect vulnerable packages early. 6) Educate developers on the risks of installing unverified packages and encourage the use of trusted sources. 7) Implement runtime monitoring and endpoint detection on developer workstations to identify suspicious activities. 8) Consider temporary workarounds such as disabling or restricting features of the vulnerable package if patches are not yet available. These targeted actions go beyond generic advice by focusing on the development lifecycle and supply chain security.
Description
Arbitrary command/code execution has been demonstrated through the exploitation of CVE-2025-11953 on Windows, macOS and Linux. The post Critical Flaw in Popular React Native NPM Package Exposes Developers to Attacks appeared first on SecurityWeek .