Threat database

CVE-2025-11953 is a critical OS command injection vulnerability in the Metro Development Server version 4.8.0 used by the React Native Community CLI. The server binds to external interfaces by default and exposes an endpoint that allows unauthenticated network attackers to execute arbitrary commands. On Windows systems, this enables attackers to run shell commands with fully controlled arguments. The vulnerability has a CVSS score of 9.8, indicating critical severity. No patch or official remediation information is currently available.