CVE-2025-11953 (Metro4Shell) in React Native
CVE-2025-11953 is a critical flaw in the Metro development server that npx react-native start runs. The server binds to external network interfaces by default and has an endpoint, /open-url, that passes part of a POST request to an operating-system open call. Anyone who can reach the server, on the same network or from a web page, can run programs on the developer's machine; on Windows, shell commands with any arguments. It is rated 9.8 (critical) and is in CISA's Known Exploited Vulnerabilities catalog since 5 February 2026.
What it affects. Developer machines and CI runners that start the bundler, not the app you ship to users.
Affected versions (official CVE record and GitHub advisory GHSA-399j-vxmf-hjvr; the same ranges for @react-native-community/cli and @react-native-community/cli-server-api):
| Version line | Affected | Fixed in |
|---|---|---|
| 18.x | 18.0.0 | 18.0.1 |
| 19.x | 19.0.0 to 19.1.1 | 19.1.2 |
| 20.x | 20.0.0 alpha releases | 20.0.0 |
Check your project. The CLI usually comes in through react-native, so your package.json does not name it. Ask the package manager which version is installed:
npm ls @react-native-community/cli-server-api
yarn why @react-native-community/cli-server-api
pnpm why @react-native-community/cli-server-apinpx nativekeel reads the exact versions resolved in your lockfile and node_modules, transitive copies included, and reports this as a critical finding when one of them is affected.
Fix. Move to the fixed release of the line you are on (18.0.1, 19.1.2 or 20.0.0), then reinstall. If it comes in through react-native, force it with your package manager:
// package.json, npm
"overrides": { "@react-native-community/cli-server-api": "19.1.2" }
// package.json, Yarn
"resolutions": { "@react-native-community/cli-server-api": "19.1.2" }
// package.json, pnpm
"pnpm": { "overrides": { "@react-native-community/cli-server-api": "19.1.2" } }Use the version from your own line (the table above), not a newer major. Run npm ls again to confirm no affected copy is left.
Until you can update, start Metro on localhost only, so other machines cannot reach it:
npx react-native start --host 127.0.0.1npx nativekeel