返回 CVE 瀏覽器

CVE-2025-11953

🔥 Known Exploited (CISA KEV)CRITICAL

9.8

CVSS Severity Score

EPSS Score0.0000%

EPSS Percentile0.00th

Published2025-11-03

Last Modified2026-06-17

Data SourcesNVDCISA KEV

Vulnerability Description

The Metro Development Server, which is opened by the React Native Community CLI, binds to external interfaces by default. The server exposes an endpoint that is vulnerable to OS command injection. This allows unauthenticated network attackers to send a POST request to the server and run arbitrary executables. On Windows, the attackers can also execute arbitrary shell commands with fully controlled arguments.

Affected Platforms (CPE)

📦

React Native Community

React Native Community Cli

>= 19.0.0 and < 19.1.2= 18.0.0= 20.0.0

References & Advisories

🔗 https://github.com/react-native-community/cli/commit/15089907d1f1301b22c72d7f68846a2ef20df547

🔗 https://jfrog.com/blog/cve-2025-11953-critical-react-native-community-cli-vulnerability

🔗 https://x.com/SzymonRybczak/status/1986199665000566848

🔗 https://x.com/thymikee/status/1986770875954475375

🔗 https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2025-11953

🔗 https://www.vulncheck.com/blog/metro4shell_eitw

相關資安分析文章

週度網絡安全新聞：2026 年 7 月 27 日

本週重大安全週報聚焦於 Check Point SmartConsole CVE-2026-16232 驗證繞過之在野利用、PAN-OS GlobalProtect 漏洞與 Qilin 勒索軟體侵襲、俄羅斯 LAUNDRY BEAR 對 Zimbra 進行之國家級郵件間諜活動，以及 Windchill 與 FakeGit 惡意 Repositories 威脅趨勢。

全球網絡威脅情報摘要：2026 年 7 月 24 日

本期情報聚焦於 Check Point CVE-2026-16232 SmartConsole 控制平面身分驗證繞過之主動利用、俄羅斯 LAUNDRY BEAR 利用 Zimbra 漏洞進行電子郵件間諜活動，以及假冒 Claude Desktop 的惡意廣告攻擊與 Chaos 勒索軟體運作動態。

全球網絡威脅情報摘要：2026 年 7 月 22 日

本期摘要重點分析本地部署 Microsoft SharePoint 伺服器正遭主動利用之 CVE-2026-50522 漏洞、Qilin 勒索軟體利用 PAN-OS CVE-2026-0257 身分驗證繞過入侵企業 VPN，以及 Cisco 安全設備與關鍵基礎設施修補處置指南。

相關漏洞威脅

In the Linux kernel, the following vulnerability has been resolved: usb: misc: usbio: fix disconnect UAF in client teardown usbi...

CVE-2026-643559.8

In the Linux kernel, the following vulnerability has been resolved: bpf: Reject fragmented frames in devmap Devmap broadcast red...

CVE-2026-660408.7

FFmpeg through 8.1.2, fixed in commit b506faf, contains a heap out-of-bounds write vulnerability in the native PNG and APNG encode...

CVE-2026-158216.4

The SureDash – Community, Courses & Member Dashboard plugin for WordPress is vulnerable to Stored Cross-Site Scripting via Shortco...