Critical React Native CLI Flaw Exposed Millions of Developers to Remote Attacks

Critical React Native CLI Vulnerability Exposes Developers to Remote Code Execution Attacks

A critical security flaw in the widely used @react-native-community/cli npm package, tracked as CVE-2025-11953, allowed unauthenticated attackers to execute arbitrary operating system (OS) commands remotely. This vulnerability, rated CVSS 9.8/10, was patched by Meta in version 20.0.0 of the package. The flaw exploited a misconfigured endpoint in the Metro development server, enabling attackers to inject OS commands via a malicious POST request.

---

Vulnerability Details

• Severity: CVSS score of 9.8 (critical severity).
• Affected Packages:
  • @react-native-community/cli versions prior to 20.0.0.
  • @react-native-community/cli-server-api versions 4.8.0 to 20.0.0-alpha.2.
• Patch Status: Resolved in version 20.0.0, released in early 2025.
• Exploitation Vector:
  • The Metro server, by default, binds to external interfaces (not localhost).
  • The /open-url endpoint accepts user input passed to the open() function from the open NPM package, which executes OS commands without sanitization.

---

Technical Explanation

• Attack Mechanism:
  • Attackers could send a crafted POST request to the /open-url endpoint.
  • The input was passed to open(), which executed arbitrary commands on Windows (full shell control) or Linux/macOS (binary execution with limited parameters).
• Root Cause:
  • Lack of input validation in the open() function.
  • Default server configuration exposing the endpoint to external networks.

---

Impact and Risk

• Scope of Exposure:
  • The @react-native-community/cli package is downloaded 1.5–2 million times weekly, affecting millions of developers.
  • Attackers could exploit this to:
    • Install malware.
    • Steal sensitive data (e.g., API keys, source code).
    • Take control of development environments.
• Zero-Day Status:
  • The vulnerability was a zero-day at the time of disclosure, with no prior patches or mitigations.
  • No known exploits in the wild, but the potential for abuse is high due to ease of exploitation.

---

Mitigation and Recommendations

• Immediate Actions:
  • Upgrade to @react-native-community/cli version 20.0.0 or later.
  • Ensure Metro server binds only to localhost (disable external access if not required).
• Best Practices:
  • Regularly update dependencies using tools like npm audit or yarn audit.
  • Use network segmentation to isolate development servers.
  • Avoid exposing development tools to public or untrusted networks.
• Long-Term Security:
  • Implement automated software supply chain scanning (e.g., using tools like Snyk or Dependabot).
  • Monitor for vulnerabilities in third-party libraries, especially those with high download counts.

---

Reference

For further details, see the original report: Critical React Native CLI Flaw Exposed Millions of Developers to Remote Attacks