CVE-2025-11953: 
JavaScript vulnerability analysis and mitigation

CVE-2025-11953, dubbed Metro4Shell, is a critical OS command injection vulnerability in the @react-native-community/cli npm package's Metro Development Server. Discovered and disclosed by JFrog Security Research on November 3–4, 2025, it affects @react-native-community/cli-server-api versions 4.8.0 through 20.0.0-alpha.2 (including the 19.x branch prior to 19.1.2). The vulnerability allows unauthenticated remote attackers to send a crafted POST request to the Metro server's /open-url endpoint and execute arbitrary OS commands — with full shell command control on Windows. It carries a CVSS v3.1 base score of 9.8 (Critical) (JFrog Blog, CISA KEV).

The root cause (CWE-78: Improper Neutralization of Special Elements used in an OS Command) lies in the openURLMiddleware handler within @react-native-community/cli-server-api. This handler accepts a JSON POST request containing a url field and passes it unsanitized directly to the open() function from the open npm package (v6.4.0). On Windows, open() internally invokes cmd /c start "" /b <url>, meaning an attacker-controlled url value such as cmd /c <malicious_command> results in arbitrary shell execution. A compounding issue in @react-native/community-cli-plugin causes the Metro server to bind to all network interfaces (0.0.0.0) by default despite displaying a misleading localhost message — because args.host (undefined when no --host flag is passed) is forwarded to Metro.runServer() instead of the resolved hostname variable. The fix (commit 15089907) adds strict URL protocol validation, rejecting any URL whose scheme is not http: or https: (JFrog Blog, GitHub Commit).

Successful exploitation grants an unauthenticated remote attacker arbitrary OS command execution on the developer's machine running the Metro server. On Windows (versions 17.0.0–20.0.0-alpha.2), this enables full shell command execution with attacker-controlled arguments; on macOS and Linux, attackers can execute arbitrary local or remote executables with limited argument control. The primary targets are software developers and CI/CD build environments, where compromise can lead to source code theft, credential harvesting, supply chain poisoning, and lateral movement within development infrastructure. The P2Pinfect malware family has been confirmed to weaponize this vulnerability in Kubernetes environments (JFrog Blog, CISA KEV, Fortinet Blog).

1. Reconnaissance: Scan the internet for hosts with TCP port 8081 open (the default Metro Development Server port) using tools like Shodan, Censys, or Masscan. Confirm the target is running a vulnerable Metro server by sending a benign GET request and checking for Metro-specific response headers or content.
2. Identify vulnerable endpoint: Confirm the /open-url endpoint is accessible by sending a test POST request with a valid HTTP URL (e.g., {"url": "http://example.com"}) and verifying a 200 response.
3. Craft injection payload (Windows): Construct a malicious POST request body targeting the command injection sink. For Windows targets, set the url field to a value that abuses the cmd /c start invocation, e.g., {"url": "cmd /c <malicious_command>"}.
4. Send exploit request: Deliver the POST request to http://<target>:8081/open-url with Content-Type: application/json. No authentication is required.
5. Achieve code execution: The Metro server passes the unsanitized url value to open(), which spawns cmd /c start "" /b cmd /c <malicious_command> on Windows, executing the attacker's payload as the user running the Metro server.
6. Establish persistence / deploy malware: Use the RCE primitive to download and execute a payload (e.g., a Rust-based implant like P2Pinfect), establish a reverse shell, or exfiltrate credentials and source code from the developer's environment (JFrog Blog, VulnCheck Blog).

• Network: Unexpected inbound POST requests to port 8081 (or custom Metro port) targeting the /open-url endpoint from external IP addresses; outbound connections from developer workstations or CI/CD nodes to unknown C2 infrastructure following Metro server activity.
• Logs: HTTP server access logs showing POST /open-url requests with non-HTTP/HTTPS URL values in the request body (e.g., cmd /c, file://, smb://); Node.js process logs showing unexpected child process spawning.
• Process: Unusual child processes spawned by the Node.js/Metro process (e.g., cmd.exe, powershell.exe, bash, curl, wget) with attacker-controlled arguments; unexpected executables launched from the Metro server's working directory.
• File System: New or modified files in the project directory or temp folders created by the Metro server process; presence of Rust-based binaries or P2Pinfect-related artifacts on developer machines or Kubernetes nodes.
• Registry / Persistence (Windows): New scheduled tasks, registry run keys, or services created by the Node.js process account following exploitation (JFrog Blog, Fortinet Blog).

Primary fix: Update @react-native-community/cli and @react-native-community/cli-server-api to version 19.1.2 (for the 19.x branch) or 20.0.0 (for the 20.x branch), which adds strict URL protocol validation to the /open-url endpoint. Verify the installed version with npm list @react-native-community/cli-server-api (or with -g for global installs). Workaround: If upgrading is not immediately possible, bind the Metro server explicitly to localhost by passing the --host 127.0.0.1 flag: npx react-native start --host 127.0.0.1. Additionally, restrict network access to port 8081 via firewall rules to prevent external connections, and disable the Metro server when not actively developing. CISA's KEV due date for federal agencies was February 26, 2026 (JFrog Blog, GitHub Commit, CISA KEV).

JFrog, the discovering vendor, published a detailed technical write-up on November 4, 2025, crediting Meta's security team for prompt handling of the disclosure. BleepingComputer, The Hacker News, SecurityWeek, The Register, and SC World all covered active exploitation, with BleepingComputer reporting that hackers were breaching developer systems via the Metro bug. VulnCheck published a dedicated exploitation-in-the-wild analysis ("Metro4Shell EITW"). The security community on Mastodon and Reddit expressed significant concern given the ~2 million weekly downloads of the affected package and the developer-targeting nature of the attack. CERT.at, CSA Singapore, and Belgium's CCB all issued advisories. Cloudflare deployed an emergency WAF rule on November 5, 2025 to protect customers (BleepingComputer, VulnCheck Blog, SecurityWeek).