Exploited Vulnerabilities DailyCVE-2025-11953: React Native Community CLI
EPSS93.9%No. 390 of 1739 in KEV
CVE year2025~1 yrs before listing
Same vendor in KEV1
Same product1
| Field | Value |
|---|---|
| Vendor | React Native Community |
| Product | CLI |
| Name | React Native Community CLI OS Command Injection Vulnerability |
| Added to KEV | 2026-02-05 |
| US federal due date | 2026-02-26 |
| Ransomware use | Unknown |
| CWE | CWE-78 |
CISA description
React Native Community CLI contains an OS command injection vulnerability which could allow unauthenticated network attackers to send POST requests to the Metro Development Server and run arbitrary executables via a vulnerable endpoint exposed by the server. On Windows, attackers can also execute arbitrary shell commands with fully controlled arguments.
Data from CISA's Known Exploited Vulnerabilities (KEV) catalog. EPSS is FIRST's estimated probability of exploitation activity in the next 30 days, refreshed weekly. Always follow the vendor's official guidance.
About this page
A React Native Community CLI vulnerability added to CISA's Known Exploited Vulnerabilities catalog on 2026-02-05.