Research · Nov 3, 2025 · ZeroDay Catalog
Critical OS Command Injection Vulnerability in React Native Community CLI
A severe OS command injection vulnerability has been identified in the React Native Community CLI, potentially allowing unauthorized execution of commands.
What changed
A significant vulnerability has been discovered in the React Native Community CLI, specifically affecting the Metro Development Server. This server, which is initiated by the CLI, is configured to bind to external interfaces by default, exposing it to potential attacks.
The vulnerability allows unauthenticated attackers to send POST requests to the server, enabling them to execute arbitrary commands on the system.
Who is affected
Organizations utilizing the React Native Community CLI are at risk, particularly those deploying applications that rely on the Metro Development Server.
This vulnerability can impact any system where the CLI is used, especially in development and production environments.
- React Native Community CLI users
- Developers using Metro Development Server
- Organizations deploying React Native applications
What to do
Immediate action is recommended to mitigate the risks associated with this vulnerability. Users should review their configurations and consider restricting access to the Metro Development Server.
Additionally, it is advisable to monitor for any unauthorized access attempts and apply security best practices.
- Restrict access to the Metro Development Server
- Monitor for unusual activity on affected systems
- Review and update security configurations