Actively exploited vulnerabilities affecting React Native Community products.https://wildfortech.comhttps://wildfortech.com/security#CVE-2025-11953https://wildfortech.com/security#CVE-2025-11953React Native Community CLI's Metro Development Server exposes an endpoint that accepts unauthenticated POST requests, allowing any attacker with network access to run arbitrary executables on the host machine. On Windows systems the risk is compounded, as attackers can also execute arbitrary shell commands with fully controlled arguments. Because this server is commonly run during development, any machine running Metro that is reachable on a shared or exposed network is potentially at risk of full system compromise.Thu, 05 Feb 2026 00:00:00 GMTReact Native CommunityCLI