React Native Community CLI - Unauthenticated OS Command Injection

id: CVE-2025-11953

info:
  name: React Native Community CLI - Unauthenticated OS Command Injection
  author: aryu-ru
  severity: critical
  description: |
    The Metro development server started by the React Native Community CLI binds to external network interfaces by default and exposes an unauthenticated /open-url endpoint. Affected versions pass the attacker supplied url value straight to the open() helper without validating the scheme, allowing an unauthenticated attacker to launch arbitrary executables on the developer machine. On Windows the request is dispatched through cmd, which permits arbitrary shell commands with fully controlled arguments. The fix was released as a backport across several release lines, so the version number alone does not indicate whether an instance is affected, and this template probes the endpoint behaviour instead.
  impact: |
    An unauthenticated attacker with network access to the bundler port can execute arbitrary programs on a developer workstation, leading to compromise of the development environment along with any source code and credentials held on it.
  remediation: |
    Upgrade @react-native-community/cli-server-api to 17.0.1, 18.0.1, 19.1.2 or 20.0.0 and later, whichever is the fixed release for the line in use. Where upgrading is not immediately possible, bind the Metro development server to the loopback interface with --host 127.0.0.1 and block inbound access to the bundler port.
  reference:
    - https://jfrog.com/blog/cve-2025-11953-critical-react-native-community-cli-vulnerability/
    - https://www.vulncheck.com/blog/metro4shell_eitw
    - https://github.com/advisories/GHSA-399j-vxmf-hjvr
    - https://github.com/react-native-community/cli/commit/15089907d1f1301b22c72d7f68846a2ef20df547
    - https://nvd.nist.gov/vuln/detail/CVE-2025-11953
  classification:
    cvss-metrics: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
    cvss-score: 9.8
    cve-id: CVE-2025-11953
    epss-score: 0.9398
    epss-percentile: 0.99838
    cwe-id: CWE-78
  metadata:
    verified: true
    max-request: 2
    vendor: react-native-community
    product: react_native_community_cli
    fofa-query: title="React Native" && port="8081"
  tags: cve,cve2025,react-native,metro,rce,unauth,intrusive,kev,vkev

flow: http(1) && http(2)

http:
  - raw:
      - |
        GET /status HTTP/1.1
        Host: {{Hostname}}

    matchers:
      - type: dsl
        dsl:
          - 'status_code == 200'
          - 'contains(body, "packager-status:running")'
          - 'contains(to_lower(header), "x-react-native-project-root")'
        condition: and
        internal: true

  - raw:
      - |
        POST /open-url HTTP/1.1
        Host: {{Hostname}}
        Content-Type: application/json

        {"url":"nuclei-probe://{{randstr}}"}

    matchers:
      - type: dsl
        dsl:
          - 'status_code == 200'
          - 'len(body) == 0'
          - '!contains(body, "Invalid URL")'
        condition: and
# digest: 4a0a004730450221008564ceb8b2a64ab300fabd62c53b7e6cbd4dbd30cb6a39ada6a391da26e31d9802201828c06a39a70e8c1f1bd4054011f1d26ac5c1604e9d188014c71e62dc9d7b55:922c64590222798bb761d5b6d8e72950