CVE-2025-11953: 
JavaScript vulnerability analysis and mitigation

CVE-2025-11953 is a critical security vulnerability (CVSS 9.8) affecting the @react-native-community/cli NPM package, which has approximately 2 million weekly downloads. The vulnerability was discovered in November 2025 and affects versions 4.8.0 through 20.0.0-alpha.2 of the @react-native-community/cli-server-api package. The Metro Development Server, which is opened by the React Native Community CLI, binds to external interfaces by default and exposes an endpoint vulnerable to OS command injection (JFrog Blog, SecurityWeek).

The vulnerability exists in the openURLMiddleware function within the packages/cli-server-api/src/openURLMiddleware.ts file. When the server receives a POST request to the /open-url endpoint, it processes a user-supplied URL parameter without proper sanitization and passes it directly to the open() function from the open NPM package. The CVSS score of 9.8 reflects the critical severity of this vulnerability, which is classified as CWE-78 (Improper Neutralization of Special Elements used in an OS Command) (JFrog Blog).

The vulnerability allows unauthenticated network attackers to execute arbitrary commands on the machine running the development server. On Windows systems, attackers can execute arbitrary shell commands with full parameter control. On macOS and Linux systems, the vulnerability enables execution of arbitrary executables with limited parameter control (JFrog Blog, Hacker News).

Two primary mitigation options are available: 1) Update @react-native-community/cli-server-api to version 20.0.0 or higher, which includes the security fix, or 2) If updating is not possible, bind the development server explicitly to localhost by using the --host 127.0.0.1 flag when starting the server (e.g., npx react-native start --host 127.0.0.1). The fix implemented in version 20.0.0 adds strict URL validation to ensure only http and https protocols are allowed (JFrog Blog, GitHub Commit).

Meta's security team and engineers responded promptly to address the vulnerability. The security community has emphasized the significance of this vulnerability due to its critical severity and the widespread use of React Native in mobile application development (JFrog Blog).