# CVE-2025-11953: React Native Community CLI OS Command Injection Vulnerability

- Exploited (CISA KEV): yes, added 2026-02-05
- Published: 2025-11-03
- CVSS: 9.8 CRITICAL (v3.1)
- EPSS: 94.0% (100th percentile)
- CWE: CWE-78

The Metro Development Server, which is opened by the React Native Community CLI, binds to external interfaces by default. The server exposes an endpoint that is vulnerable to OS command injection. This allows unauthenticated network attackers to send a POST request to the server and run arbitrary executables. On Windows, the attackers can also execute arbitrary shell commands with fully controlled arguments.

## Edge WAF coverage (claimed by vendors, not measured)

| Vendor | Status | First rule | Days after publication |
|---|---|---|---|
| Cloudflare | Blocks by default | 2025-11-05 | 2 |
| AWS | No public claim | — | — |
| Microsoft Azure | No public claim | — | — |
| Google Cloud | No public claim | — | — |
| Fastly | Before feed history | — | — |
| F5 | No public claim | — | — |
| Akamai | No public source | — | — |
| OWASP CRS | No public claim | — | — |

### Cloudflare

- 2025-11-05 · new · rule db6b9e1ac1494971ae8c70aac8e30c5b · default Block
  > React Native Metro - Command Injection - CVE:CVE-2025-11953. Previous action: N/A. New action: Block. This is a New Detection
  Source: https://developers.cloudflare.com/changelog/post/2025-11-05-emergency-waf-release/

## Our test (measured)

- OWASP Core Rule Set 4.25.0, paranoia level 1, anomaly threshold 5, default CRS settings: passed (0 of 2 requests blocked), template CVE-2025-11953, 2026-11-02
- OWASP Core Rule Set 4.25.0, paranoia level 2, anomaly threshold 5, default CRS settings: passed (0 of 2 requests blocked), template CVE-2025-11953, 2026-11-02

"No public claim" means no vendor statement names this CVE; "Before feed history" means the CVE is older than the vendor feed. In both cases generic rules may still block it.

HTML: https://cve.vigilbase.com/cve/CVE-2025-11953 · JSON: https://cve.vigilbase.com/api/v1/cves/CVE-2025-11953