Subj : Millions of developers could be open to attack after critical fla
To   : All
From : TechnologyDaily
Date : Wed Nov 05 2025 15:30:08

Millions of developers could be open to attack after critical flaw exploited 
- here's what we know

Date:
Wed, 05 Nov 2025 15:06:00 +0000

Description:
An npm package with 2 million weekly downloads found vulnerable but a patch 
is available.

FULL STORY
======================================================================CVE-2025
-11953 allows OS command injection via Metro server in React Native CLI 
Affects versions 4.8.020.0.0-alpha.2; patched in 20.0.0; exploit requires no 
authentication No confirmed exploitation yet; restrict server exposure or 
update immediately 

A widely popular npm package carried a critical severity vulnerability that 
allowed threat actors to, in certain scenarios, run malicious commands, 
experts have warned. 

Cybersecurity researchers from JFrog say the package in question is called 
@react-native-community/cli, made to help developers build React Native 
mobile applications, and getting up to two million downloads a week. 

On NVD, it is explained the Metro Development Server, opened by the React 
Native Community CLI, binds to external interfaces by default. The server 
exposes an endpoint vulnerable to OS command injection, allowing threat 
actors to send a POST request and run arbitrary executables - meaning on 
Windows, the attackers can also execute arbitrary shell commands with fully 
controlled arguments, and on Linux and macOS, on the other hand, it can 
execute arbitrary binaries with limited parameter control. Acting like 
hacktivists 

The bug is tracked as CVE-2025-11953, and has a severity score of 9.8/10 
(critical). It affects package versions 4.8.0 through 20.0.0-alpha.2, and has 
been patched in version 20.0.0 released early last month. Those that cannot 
immediately update their endpoints should restrict network exposure of the 
Metro server. 

If you are using React Native with a framework that doesnt rely on Metro as a 
development server, you are not affected, it was further stated. "This zero 
day vulnerability is particularly dangerous due to its ease of exploitation, 
lack of authentication requirements and broad attack surface," JFrogs 
researchers explained. "It also exposes the critical risks hidden in 
third-party code." 

"For developer and security teams, this underscores the need for automated, 
comprehensive security scanning across the software supply chain to ensure 
easily exploitable flaws are remediated before they impact your 
organization." 

At press time, there were no confirmed public reports that CVE202511953 had 
been exploited in the wild. Multiple sources indicate that while the 
vulnerability is highly exploitable, actual exploit activity hasnt yet been 
verified. 

 Via The Hacker News 

 Follow TechRadar on Google News and add us as a preferred source to get our 
expert news, reviews, and opinion in your feeds. Make sure to click the 
Follow button! 

 And of course you can also follow TechRadar on TikTok for news, reviews, 
unboxings in video form, and get regular updates from us on WhatsApp too.



======================================================================
Link to news story:
https://www.techradar.com/pro/security/millions-of-developers-could-be-open-to
-attack-after-critical-flaw-exploited-heres-what-we-know


--- Mystic BBS v1.12 A49 (Linux/64)
 * Origin: tqwNet Technology News (1337:1/100)

.