Every CVE Search/ Get API key

CVE-2025-11953

Command injection in React Native Community CLI allows remote attackers to perform remote code execution by sending HTTP requests

9.8 CriticalIn KEVPublic exploitFix available

The Metro Development Server, which is opened by the React Native Community CLI, binds to external interfaces by default. The server exposes an endpoint that is vulnerable to OS command injection. This allows unauthenticated network attackers to send a POST request to the server and run arbitrary executables. On Windows, the attackers can also execute arbitrary shell commands with fully controlled arguments.

Attack profile

How easy it is to exploit

Attack vector
Network
Complexity
Low
Privileges needed
None
User interaction
None

What an attacker can affect

Confidentiality
High
Integrity
High
Availability
High

Exploit likelihood

94.0%Up 93.7 points since Nov 4, 2025
90%50%10%1%

What each source reports

CVE List Score used 9.8

Command injection in React Native Community CLI allows remote attackers to perform remote code execution by sending HTTP requests

The Metro Development Server, which is opened by the React Native Community CLI, binds to external interfaces by default. The server exposes an endpoint that is vulnerable to OS command injection. This allows unauthenticated network attackers to send a POST request to the server and run arbitrary executables. On Windows, the attackers can also execute arbitrary shell commands with fully controlled arguments.

Record
CVE-2025-11953
CVSS 3.1
9.8 CriticalCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Weakness
CWE-78
Updated
2026-11-02
EUVDEUVD-2025-37505 9.8

The Metro Development Server, which is opened by the React Native Community CLI, binds to external interfaces by default. The server exposes an endpoint that is vulnerable to OS command injection. This allows unauthenticated network attackers to send a POST request to the server and run arbitrary executables. On Windows, the attackers can also execute arbitrary shell commands with fully controlled arguments.

Record
EUVD-2025-37505
CVSS 3.1
9.8 CriticalCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Updated
2026-11-02
GitHub AdvisoriesGHSA-399j-vxmf-hjvr 9.8

@react-native-community/cli has arbitrary OS command injection

The Metro Development Server, which is opened by the React Native CLI, binds to external interfaces by default. The server exposes an endpoint that is vulnerable to OS command injection. This allows unauthenticated network attackers to send a POST request to the server and run arbitrary executables. On Windows, the attackers can also execute arbitrary shell commands with fully controlled arguments.

Record
GHSA-399j-vxmf-hjvr
CVSS 3.1
9.8 CriticalCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Weakness
CWE-78
Updated
2026-11-02
CISA KEV No score

React Native Community CLI OS Command Injection Vulnerability

React Native Community CLI contains an OS command injection vulnerability which could allow unauthenticated network attackers to send POST requests to the Metro Development Server and run arbitrary executables via a vulnerable endpoint exposed by the server. On Windows, attackers can also execute arbitrary shell commands with fully controlled arguments.

Record
CVE-2025-11953
Weakness
CWE-78
Updated
2026-11-02
NVD 9.8

The Metro Development Server, which is opened by the React Native Community CLI, binds to external interfaces by default. The server exposes an endpoint that is vulnerable to OS command injection. This allows unauthenticated network attackers to send a POST request to the server and run arbitrary executables. On Windows, the attackers can also execute arbitrary shell commands with fully controlled arguments.

Record
CVE-2025-11953
CVSS 3.1
9.8 CriticalCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Weakness
CWE-78
Updated
2026-11-05
OSV 9.8

Command injection in React Native Community CLI allows remote attackers to perform remote code execution by sending HTTP requests

The Metro Development Server, which is opened by the React Native Community CLI, binds to external interfaces by default. The server exposes an endpoint that is vulnerable to OS command injection. This allows unauthenticated network attackers to send a POST request to the server and run arbitrary executables. On Windows, the attackers can also execute arbitrary shell commands with fully controlled arguments.

Record
CVE-2025-11953
CVSS 3.1
9.8 CriticalCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Weakness
CWE-78
Updated
2026-11-07
Show 47 moreShow less
OSVGHSA-399j-vxmf-hjvr 9.8

@react-native-community/cli has arbitrary OS command injection

The Metro Development Server, which is opened by the React Native CLI, binds to external interfaces by default. The server exposes an endpoint that is vulnerable to OS command injection. This allows unauthenticated network attackers to send a POST request to the server and run arbitrary executables. On Windows, the attackers can also execute arbitrary shell commands with fully controlled arguments.

Record
GHSA-399j-vxmf-hjvr
CVSS 3.1
9.8 CriticalCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Weakness
CWE-78
Updated
2026-11-02
OSVCLSA-2026-1789566692 No score

TuxCare security update for @react-native-community/cli (1 CVE)

TuxCare rebuilt @react-native-community/cli to address 1 CVE. Fixed in 15.1.3-tuxcare.2.

Record
CLSA-2026-1789566692
Updated
2026-11-02
OSVCLSA-2026-1789568169 No score

TuxCare security update for @react-native-community/cli (1 CVE)

TuxCare rebuilt @react-native-community/cli to address 1 CVE. Fixed in 12.3.7-tuxcare.2.

Record
CLSA-2026-1789568169
Updated
2026-11-02
OSVCLSA-2026-1790866461 No score

TuxCare security update for @react-native-community/cli (1 CVE)

TuxCare rebuilt @react-native-community/cli to address 1 CVE. Fixed in 2.0.2-tuxcare.1.

Record
CLSA-2026-1790866461
Updated
2026-11-02
OSVCLSA-2026-1790869390 No score

TuxCare security update for @react-native-community/cli (1 CVE)

TuxCare rebuilt @react-native-community/cli to address 1 CVE. Fixed in 5.0.1-tuxcare.1.

Record
CLSA-2026-1790869390
Updated
2026-11-02
OSVCLSA-2026-1790870094 No score

TuxCare security update for @react-native-community/cli (1 CVE)

TuxCare rebuilt @react-native-community/cli to address 1 CVE. Fixed in 12.3.0-tuxcare.1.

Record
CLSA-2026-1790870094
Updated
2026-11-02
OSVCLSA-2026-1790871357 No score

TuxCare security update for @react-native-community/cli (1 CVE)

TuxCare rebuilt @react-native-community/cli to address 1 CVE. Fixed in 12.3.2-tuxcare.1.

Record
CLSA-2026-1790871357
Updated
2026-11-02
OSVCLSA-2026-1790877607 No score

TuxCare security update for @react-native-community/cli (1 CVE)

TuxCare rebuilt @react-native-community/cli to address 1 CVE. Fixed in 12.3.6-tuxcare.1.

Record
CLSA-2026-1790877607
Updated
2026-11-02
OSVCLSA-2026-1790877670 No score

TuxCare security update for @react-native-community/cli-debugger-ui (1 CVE)

TuxCare rebuilt @react-native-community/cli-debugger-ui to address 1 CVE. Fixed in 12.0.0-alpha.17-tuxcare.1.

Record
CLSA-2026-1790877670
Updated
2026-11-02
OSVCLSA-2026-1790878081 No score

TuxCare security update for @react-native-community/cli-debugger-ui (1 CVE)

TuxCare rebuilt @react-native-community/cli-debugger-ui to address 1 CVE. Fixed in 12.0.0-alpha.15-tuxcare.1.

Record
CLSA-2026-1790878081
Updated
2026-11-02
OSVCLSA-2026-1790878902 No score

TuxCare security update for @react-native-community/cli (1 CVE)

TuxCare rebuilt @react-native-community/cli to address 1 CVE. Fixed in 13.6.8-tuxcare.1.

Record
CLSA-2026-1790878902
Updated
2026-11-02
OSVCLSA-2026-1790879434 No score

TuxCare security update for @react-native-community/cli (1 CVE)

TuxCare rebuilt @react-native-community/cli to address 1 CVE. Fixed in 13.5.1-tuxcare.1.

Record
CLSA-2026-1790879434
Updated
2026-11-02
OSVCLSA-2026-1790884245 No score

TuxCare security update for @react-native-community/cli (1 CVE)

TuxCare rebuilt @react-native-community/cli to address 1 CVE. Fixed in 13.6.9-tuxcare.3.

Record
CLSA-2026-1790884245
Updated
2026-11-02
OSVCLSA-2026-1792226841 No score

TuxCare security update for @react-native-community/cli-tools (1 CVE)

TuxCare rebuilt @react-native-community/cli-tools to address 1 CVE. Fixed in 15.1.3-tuxcare.2.

Record
CLSA-2026-1792226841
Updated
2026-11-02
OSVCLSA-2026-1792226842 No score

TuxCare security update for @react-native-community/cli-tools (1 CVE)

TuxCare rebuilt @react-native-community/cli-tools to address 1 CVE. Fixed in 12.3.7-tuxcare.2.

Record
CLSA-2026-1792226842
Updated
2026-11-02
OSVCLSA-2026-1792226843 No score

TuxCare security update for @react-native-community/cli-tools (1 CVE)

TuxCare rebuilt @react-native-community/cli-tools to address 1 CVE. Fixed in 2.0.2-tuxcare.1.

Record
CLSA-2026-1792226843
Updated
2026-11-02
OSVCLSA-2026-1792226844 No score

TuxCare security update for @react-native-community/cli-tools (1 CVE)

TuxCare rebuilt @react-native-community/cli-tools to address 1 CVE. Fixed in 5.0.1-tuxcare.1.

Record
CLSA-2026-1792226844
Updated
2026-11-02
OSVCLSA-2026-1792226845 No score

TuxCare security update for @react-native-community/cli-tools (1 CVE)

TuxCare rebuilt @react-native-community/cli-tools to address 1 CVE. Fixed in 12.3.0-tuxcare.1.

Record
CLSA-2026-1792226845
Updated
2026-11-02
OSVCLSA-2026-1792226846 No score

TuxCare security update for @react-native-community/cli-tools (1 CVE)

TuxCare rebuilt @react-native-community/cli-tools to address 1 CVE. Fixed in 12.3.2-tuxcare.1.

Record
CLSA-2026-1792226846
Updated
2026-11-02
OSVCLSA-2026-1792226847 No score

TuxCare security update for @react-native-community/cli-tools (1 CVE)

TuxCare rebuilt @react-native-community/cli-tools to address 1 CVE. Fixed in 12.3.6-tuxcare.1.

Record
CLSA-2026-1792226847
Updated
2026-11-02
OSVCLSA-2026-1792226848 No score

TuxCare security update for @react-native-community/cli-tools (1 CVE)

TuxCare rebuilt @react-native-community/cli-tools to address 1 CVE. Fixed in 12.0.0-alpha.17-tuxcare.1.

Record
CLSA-2026-1792226848
Updated
2026-11-02
OSVCLSA-2026-1792226849 No score

TuxCare security update for @react-native-community/cli-tools (1 CVE)

TuxCare rebuilt @react-native-community/cli-tools to address 1 CVE. Fixed in 12.0.0-alpha.15-tuxcare.1.

Record
CLSA-2026-1792226849
Updated
2026-11-02
OSVCLSA-2026-1792226850 No score

TuxCare security update for @react-native-community/cli-tools (1 CVE)

TuxCare rebuilt @react-native-community/cli-tools to address 1 CVE. Fixed in 13.6.8-tuxcare.1.

Record
CLSA-2026-1792226850
Updated
2026-11-02
OSVCLSA-2026-1792226851 No score

TuxCare security update for @react-native-community/cli-tools (1 CVE)

TuxCare rebuilt @react-native-community/cli-tools to address 1 CVE. Fixed in 13.5.1-tuxcare.1.

Record
CLSA-2026-1792226851
Updated
2026-11-02
OSVCLSA-2026-1792226852 No score

TuxCare security update for @react-native-community/cli-tools (1 CVE)

TuxCare rebuilt @react-native-community/cli-tools to address 1 CVE. Fixed in 13.6.9-tuxcare.3.

Record
CLSA-2026-1792226852
Updated
2026-11-02
OSVCLSA-2026-1792255998 No score

TuxCare security update for @react-native-community/cli-server-api (1 CVE)

TuxCare rebuilt @react-native-community/cli-server-api to address 1 CVE. Fixed in 15.1.3-tuxcare.2.

Record
CLSA-2026-1792255998
Updated
2026-11-02
OSVCLSA-2026-1792255999 No score

TuxCare security update for @react-native-community/cli-server-api (1 CVE)

TuxCare rebuilt @react-native-community/cli-server-api to address 1 CVE. Fixed in 12.3.7-tuxcare.2.

Record
CLSA-2026-1792255999
Updated
2026-11-02
OSVCLSA-2026-1792256000 No score

TuxCare security update for @react-native-community/cli-server-api (1 CVE)

TuxCare rebuilt @react-native-community/cli-server-api to address 1 CVE. Fixed in 12.3.0-tuxcare.1.

Record
CLSA-2026-1792256000
Updated
2026-11-02
OSVCLSA-2026-1792256001 No score

TuxCare security update for @react-native-community/cli-server-api (1 CVE)

TuxCare rebuilt @react-native-community/cli-server-api to address 1 CVE. Fixed in 5.0.1-tuxcare.1.

Record
CLSA-2026-1792256001
Updated
2026-11-02
OSVCLSA-2026-1792256002 No score

TuxCare security update for @react-native-community/cli-server-api (1 CVE)

TuxCare rebuilt @react-native-community/cli-server-api to address 1 CVE. Fixed in 12.3.2-tuxcare.1.

Record
CLSA-2026-1792256002
Updated
2026-11-02
OSVCLSA-2026-1792256003 No score

TuxCare security update for @react-native-community/cli-server-api (1 CVE)

TuxCare rebuilt @react-native-community/cli-server-api to address 1 CVE. Fixed in 12.3.6-tuxcare.1.

Record
CLSA-2026-1792256003
Updated
2026-11-02
OSVCLSA-2026-1792256004 No score

TuxCare security update for @react-native-community/cli-server-api (1 CVE)

TuxCare rebuilt @react-native-community/cli-server-api to address 1 CVE. Fixed in 12.0.0-alpha.17-tuxcare.1.

Record
CLSA-2026-1792256004
Updated
2026-11-02
OSVCLSA-2026-1792256005 No score

TuxCare security update for @react-native-community/cli-server-api (1 CVE)

TuxCare rebuilt @react-native-community/cli-server-api to address 1 CVE. Fixed in 12.0.0-alpha.15-tuxcare.1.

Record
CLSA-2026-1792256005
Updated
2026-11-02
OSVCLSA-2026-1792256007 No score

TuxCare security update for @react-native-community/cli-server-api (1 CVE)

TuxCare rebuilt @react-native-community/cli-server-api to address 1 CVE. Fixed in 13.6.8-tuxcare.1.

Record
CLSA-2026-1792256007
Updated
2026-11-02
OSVCLSA-2026-1792256008 No score

TuxCare security update for @react-native-community/cli-server-api (1 CVE)

TuxCare rebuilt @react-native-community/cli-server-api to address 1 CVE. Fixed in 13.5.1-tuxcare.1.

Record
CLSA-2026-1792256008
Updated
2026-11-02
OSVCLSA-2026-1792256009 No score

TuxCare security update for @react-native-community/cli-server-api (1 CVE)

TuxCare rebuilt @react-native-community/cli-server-api to address 1 CVE. Fixed in 13.6.9-tuxcare.3.

Record
CLSA-2026-1792256009
Updated
2026-11-02
OSVCLSA-2026-1792595218 No score

TuxCare security update for @react-native-community/cli-platform-android (1 CVE)

TuxCare rebuilt @react-native-community/cli-platform-android to address 1 CVE. Fixed in 15.1.3-tuxcare.2.

Record
CLSA-2026-1792595218
Updated
2026-11-02
OSVCLSA-2026-1792595220 No score

TuxCare security update for @react-native-community/cli-platform-android (1 CVE)

TuxCare rebuilt @react-native-community/cli-platform-android to address 1 CVE. Fixed in 12.3.7-tuxcare.2.

Record
CLSA-2026-1792595220
Updated
2026-11-02
OSVCLSA-2026-1792595221 No score

TuxCare security update for @react-native-community/cli-platform-android (1 CVE)

TuxCare rebuilt @react-native-community/cli-platform-android to address 1 CVE. Fixed in 2.0.2-tuxcare.1.

Record
CLSA-2026-1792595221
Updated
2026-11-02
OSVCLSA-2026-1792595222 No score

TuxCare security update for @react-native-community/cli-platform-android (1 CVE)

TuxCare rebuilt @react-native-community/cli-platform-android to address 1 CVE. Fixed in 12.3.0-tuxcare.1.

Record
CLSA-2026-1792595222
Updated
2026-11-02
OSVCLSA-2026-1792595223 No score

TuxCare security update for @react-native-community/cli-platform-android (1 CVE)

TuxCare rebuilt @react-native-community/cli-platform-android to address 1 CVE. Fixed in 12.3.6-tuxcare.1.

Record
CLSA-2026-1792595223
Updated
2026-11-02
OSVCLSA-2026-1792595224 No score

TuxCare security update for @react-native-community/cli-platform-android (1 CVE)

TuxCare rebuilt @react-native-community/cli-platform-android to address 1 CVE. Fixed in 13.6.9-tuxcare.3.

Record
CLSA-2026-1792595224
Updated
2026-11-02
OSVCLSA-2026-1792595225 No score

TuxCare security update for @react-native-community/cli-platform-android (1 CVE)

TuxCare rebuilt @react-native-community/cli-platform-android to address 1 CVE. Fixed in 11.4.1-tuxcare.4.

Record
CLSA-2026-1792595225
Updated
2026-11-02
OSVCLSA-2026-1792595226 No score

TuxCare security update for @react-native-community/cli-platform-android (1 CVE)

TuxCare rebuilt @react-native-community/cli-platform-android to address 1 CVE. Fixed in 5.0.1-tuxcare.1.

Record
CLSA-2026-1792595226
Updated
2026-11-02
OSVCLSA-2026-1792595227 No score

TuxCare security update for @react-native-community/cli-platform-android (1 CVE)

TuxCare rebuilt @react-native-community/cli-platform-android to address 1 CVE. Fixed in 12.3.2-tuxcare.1.

Record
CLSA-2026-1792595227
Updated
2026-11-02
OSVCLSA-2026-1792595228 No score

TuxCare security update for @react-native-community/cli-platform-android (1 CVE)

TuxCare rebuilt @react-native-community/cli-platform-android to address 1 CVE. Fixed in 13.6.8-tuxcare.1.

Record
CLSA-2026-1792595228
Updated
2026-11-02
OSVCLSA-2026-1792595229 No score

TuxCare security update for @react-native-community/cli-platform-android (1 CVE)

TuxCare rebuilt @react-native-community/cli-platform-android to address 1 CVE. Fixed in 13.5.1-tuxcare.1.

Record
CLSA-2026-1792595229
Updated
2026-11-02

Affected products

Affected packages

Affected packages
PackageAffectedFixed
@react-native-community/cli
npm
 20.0.0-alpha.0 up to 20.0.0
20.0.0
@react-native-community/cli
npm
 19.0.0-alpha.0 up to 19.1.2
19.1.2
@react-native-community/cli
npm
 18.0.0 up to 18.0.1
18.0.1
@react-native-community/cli-server-api
npm
 20.0.0-alpha.0 up to 20.0.0
20.0.0
@react-native-community/cli-server-api
npm
 19.0.0-alpha.0 up to 19.1.2
19.1.2
@react-native-community/cli-server-api
npm
 18.0.0 up to 18.0.1
18.0.1
@react-native-community/cli
TuxCare:npm
 15.1.3-tuxcare.0 up to 15.1.3-tuxcare.2, plus listed versions
15.1.315.1.3-tuxcare.1
15.1.3-tuxcare.2
@react-native-community/cli
TuxCare:npm
 12.3.7-tuxcare.0 up to 12.3.7-tuxcare.2, plus listed versions
12.3.712.3.7-tuxcare.1
12.3.7-tuxcare.2
@react-native-community/cli
TuxCare:npm
 2.0.2-tuxcare.0 up to 2.0.2-tuxcare.1, plus listed versions
2.0.2
2.0.2-tuxcare.1
@react-native-community/cli
TuxCare:npm
 5.0.1-tuxcare.0 up to 5.0.1-tuxcare.1, plus listed versions
5.0.1
5.0.1-tuxcare.1
Show 42 moreShow less
Affected packages
PackageAffectedFixed
@react-native-community/cli
TuxCare:npm
 12.3.0-tuxcare.0 up to 12.3.0-tuxcare.1, plus listed versions
12.3.0
12.3.0-tuxcare.1
@react-native-community/cli
TuxCare:npm
 12.3.2-tuxcare.0 up to 12.3.2-tuxcare.1, plus listed versions
12.3.2
12.3.2-tuxcare.1
@react-native-community/cli
TuxCare:npm
 12.3.6-tuxcare.0 up to 12.3.6-tuxcare.1, plus listed versions
12.3.6
12.3.6-tuxcare.1
@react-native-community/cli-debugger-ui
TuxCare:npm
 12.0.0-alpha.17-tuxcare.0 up to 12.0.0-alpha.17-tuxcare.1, plus listed versions
12.0.0-alpha.17
12.0.0-alpha.17-tuxcare.1
@react-native-community/cli-debugger-ui
TuxCare:npm
 12.0.0-alpha.15-tuxcare.0 up to 12.0.0-alpha.15-tuxcare.1, plus listed versions
12.0.0-alpha.15
12.0.0-alpha.15-tuxcare.1
@react-native-community/cli
TuxCare:npm
 13.6.8-tuxcare.0 up to 13.6.8-tuxcare.1, plus listed versions
13.6.8
13.6.8-tuxcare.1
@react-native-community/cli
TuxCare:npm
 13.5.1-tuxcare.0 up to 13.5.1-tuxcare.1, plus listed versions
13.5.1
13.5.1-tuxcare.1
@react-native-community/cli
TuxCare:npm
 13.6.9-tuxcare.0 up to 13.6.9-tuxcare.3, plus listed versions
13.6.913.6.9-tuxcare.113.6.9-tuxcare.2
13.6.9-tuxcare.3
@react-native-community/cli-tools
TuxCare:npm
 15.1.3-tuxcare.0 up to 15.1.3-tuxcare.2, plus listed versions
15.1.315.1.3-tuxcare.1
15.1.3-tuxcare.2
@react-native-community/cli-tools
TuxCare:npm
 12.3.7-tuxcare.0 up to 12.3.7-tuxcare.2, plus listed versions
12.3.712.3.7-tuxcare.1
12.3.7-tuxcare.2
@react-native-community/cli-tools
TuxCare:npm
 2.0.2-tuxcare.0 up to 2.0.2-tuxcare.1, plus listed versions
2.0.2
2.0.2-tuxcare.1
@react-native-community/cli-tools
TuxCare:npm
 5.0.1-tuxcare.0 up to 5.0.1-tuxcare.1, plus listed versions
5.0.1
5.0.1-tuxcare.1
@react-native-community/cli-tools
TuxCare:npm
 12.3.0-tuxcare.0 up to 12.3.0-tuxcare.1, plus listed versions
12.3.0
12.3.0-tuxcare.1
@react-native-community/cli-tools
TuxCare:npm
 12.3.2-tuxcare.0 up to 12.3.2-tuxcare.1, plus listed versions
12.3.2
12.3.2-tuxcare.1
@react-native-community/cli-tools
TuxCare:npm
 12.3.6-tuxcare.0 up to 12.3.6-tuxcare.1, plus listed versions
12.3.6
12.3.6-tuxcare.1
@react-native-community/cli-tools
TuxCare:npm
 12.0.0-alpha.17-tuxcare.0 up to 12.0.0-alpha.17-tuxcare.1, plus listed versions
12.0.0-alpha.17
12.0.0-alpha.17-tuxcare.1
@react-native-community/cli-tools
TuxCare:npm
 12.0.0-alpha.15-tuxcare.0 up to 12.0.0-alpha.15-tuxcare.1, plus listed versions
12.0.0-alpha.15
12.0.0-alpha.15-tuxcare.1
@react-native-community/cli-tools
TuxCare:npm
 13.6.8-tuxcare.0 up to 13.6.8-tuxcare.1, plus listed versions
13.6.8
13.6.8-tuxcare.1
@react-native-community/cli-tools
TuxCare:npm
 13.5.1-tuxcare.0 up to 13.5.1-tuxcare.1, plus listed versions
13.5.1
13.5.1-tuxcare.1
@react-native-community/cli-tools
TuxCare:npm
 13.6.9-tuxcare.0 up to 13.6.9-tuxcare.3, plus listed versions
13.6.913.6.9-tuxcare.113.6.9-tuxcare.2
13.6.9-tuxcare.3
@react-native-community/cli-server-api
TuxCare:npm
 15.1.3-tuxcare.0 up to 15.1.3-tuxcare.2, plus listed versions
15.1.315.1.3-tuxcare.1
15.1.3-tuxcare.2
@react-native-community/cli-server-api
TuxCare:npm
 12.3.7-tuxcare.0 up to 12.3.7-tuxcare.2, plus listed versions
12.3.712.3.7-tuxcare.1
12.3.7-tuxcare.2
@react-native-community/cli-server-api
TuxCare:npm
 12.3.0-tuxcare.0 up to 12.3.0-tuxcare.1, plus listed versions
12.3.0
12.3.0-tuxcare.1
@react-native-community/cli-server-api
TuxCare:npm
 5.0.1-tuxcare.0 up to 5.0.1-tuxcare.1, plus listed versions
5.0.1
5.0.1-tuxcare.1
@react-native-community/cli-server-api
TuxCare:npm
 12.3.2-tuxcare.0 up to 12.3.2-tuxcare.1, plus listed versions
12.3.2
12.3.2-tuxcare.1
@react-native-community/cli-server-api
TuxCare:npm
 12.3.6-tuxcare.0 up to 12.3.6-tuxcare.1, plus listed versions
12.3.6
12.3.6-tuxcare.1
@react-native-community/cli-server-api
TuxCare:npm
 12.0.0-alpha.17-tuxcare.0 up to 12.0.0-alpha.17-tuxcare.1, plus listed versions
12.0.0-alpha.17
12.0.0-alpha.17-tuxcare.1
@react-native-community/cli-server-api
TuxCare:npm
 12.0.0-alpha.15-tuxcare.0 up to 12.0.0-alpha.15-tuxcare.1, plus listed versions
12.0.0-alpha.15
12.0.0-alpha.15-tuxcare.1
@react-native-community/cli-server-api
TuxCare:npm
 13.6.8-tuxcare.0 up to 13.6.8-tuxcare.1, plus listed versions
13.6.8
13.6.8-tuxcare.1
@react-native-community/cli-server-api
TuxCare:npm
 13.5.1-tuxcare.0 up to 13.5.1-tuxcare.1, plus listed versions
13.5.1
13.5.1-tuxcare.1
@react-native-community/cli-server-api
TuxCare:npm
 13.6.9-tuxcare.0 up to 13.6.9-tuxcare.3, plus listed versions
13.6.913.6.9-tuxcare.113.6.9-tuxcare.2
13.6.9-tuxcare.3
@react-native-community/cli-platform-android
TuxCare:npm
 15.1.3-tuxcare.0 up to 15.1.3-tuxcare.2, plus listed versions
15.1.315.1.3-tuxcare.1
15.1.3-tuxcare.2
@react-native-community/cli-platform-android
TuxCare:npm
 12.3.7-tuxcare.0 up to 12.3.7-tuxcare.2, plus listed versions
12.3.712.3.7-tuxcare.1
12.3.7-tuxcare.2
@react-native-community/cli-platform-android
TuxCare:npm
 2.0.2-tuxcare.0 up to 2.0.2-tuxcare.1, plus listed versions
2.0.2
2.0.2-tuxcare.1
@react-native-community/cli-platform-android
TuxCare:npm
 12.3.0-tuxcare.0 up to 12.3.0-tuxcare.1, plus listed versions
12.3.0
12.3.0-tuxcare.1
@react-native-community/cli-platform-android
TuxCare:npm
 12.3.6-tuxcare.0 up to 12.3.6-tuxcare.1, plus listed versions
12.3.6
12.3.6-tuxcare.1
@react-native-community/cli-platform-android
TuxCare:npm
 13.6.9-tuxcare.0 up to 13.6.9-tuxcare.3, plus listed versions
13.6.913.6.9-tuxcare.1
13.6.9-tuxcare.3
@react-native-community/cli-platform-android
TuxCare:npm
 11.4.1-tuxcare.0 up to 11.4.1-tuxcare.4, plus listed versions
11.4.111.4.1-tuxcare.111.4.1-tuxcare.211.4.1-tuxcare.3
11.4.1-tuxcare.4
@react-native-community/cli-platform-android
TuxCare:npm
 5.0.1-tuxcare.0 up to 5.0.1-tuxcare.1, plus listed versions
5.0.1
5.0.1-tuxcare.1
@react-native-community/cli-platform-android
TuxCare:npm
 12.3.2-tuxcare.0 up to 12.3.2-tuxcare.1, plus listed versions
12.3.2
12.3.2-tuxcare.1
@react-native-community/cli-platform-android
TuxCare:npm
 13.6.8-tuxcare.0 up to 13.6.8-tuxcare.1, plus listed versions
13.6.8
13.6.8-tuxcare.1
@react-native-community/cli-platform-android
TuxCare:npm
 13.5.1-tuxcare.0 up to 13.5.1-tuxcare.1, plus listed versions
13.5.1
13.5.1-tuxcare.1

Public exploits

Links only. Every CVE stores no exploit code.

Public exploits
SourceLinkDate
PoC in GitHubSaidBenaissa/cve-2025-11953-vulnerability-demo2025-11-04
PoC in GitHubMr-In4inci3le/CVE-2025-11953-POC-2026-01-12
PoC in GitHubboroeurnprach/CVE-2025-11953-PoC2026-01-15
NucleiReact Native Community CLI - Unauthenticated OS Command Injection

History

History
RecordedChangedSources
exploitation, exploits
first indexedCVE List, EUVD, GitHub Advisories, CISA KEV, Nuclei, NVD, OSV, PoC in GitHub

Dates are when Every CVE recorded each change. Upstream dates may differ.

In short

CVE-2025-11953 is a critical vulnerability (CVSS 9.8) in React Native Community Cli, published November 3, 2025. CISA lists it as known to be exploited, since February 5, 2026. EUVD reports exploitation since February 5, 2026. Public exploit code exists. EPSS puts the chance of exploitation in the next 30 days at 94.0%, the 99th percentile. Fixed in @react-native-community/cli 20.0.0.

References

Show 13 moreShow less
Pages All vulnerabilities Browse Docs Sources Guide Get API key
MoveEnter Open