Skip to content
KitploitKITPLOIT
ToolsBlog
Submit
ToolsBlog
Submit

Hacking, PenTest, and Cybersecurity Tools for Your Security Arsenal!

Kitploit is a directory of hacking, cybersecurity, and pentesting tools. Discover the latest project updates to find vulnerabilities, analyze systems, automate testing, and strengthen your security.

··Feeds·Contact·Privacy·© 2026 Kitploit

Tool Directory

Categories

View all categories
Loading categories
cve-2025-11953-vulnerability-demo — CVE-2025-11953 demonstration: Critical RCE vulnerability in React Native CLI (CVSS 9.8). Educational security research with proof-of-concept exploits and mitigation strategies. | Kitploit
Tools/GitHubGitHub/saidbenaissa/cve-2025-11953-vulnerability-demo
Vulnerability AnalysisExploitationWeb Application ExploitationPenetration TestingCommand and ControlLearning & Education
GitHubsaidbenaissa/cve-2025-11953-vulnerability-demo

cve-2025-11953-vulnerability-demo

CVE-2025-11953 demonstration: Critical RCE vulnerability in React Native CLI (CVSS 9.8). Educational security research with proof-of-concept exploits and mitigation strategies.

View Repository
41110 months agoNot yet reviewed

Most Popular

View all →

Discover the most used tools by our community.

Explore all tools

Browse our collection of tools

View all tools →
Share

React Native CLI Command Injection Demo (CVE-2025-11953)

⚠️ VULNERABILITY DEMONSTRATION ⚠️

JFSA-2025-001495618 - Critical Command Injection in React Native CLI

  • CVE: CVE-2025-11953
  • CVSS Score: 9.8 (Critical)
  • Affected Package: @react-native-community/cli-server-api
  • Vulnerable Versions: [4.8.0, 20.0.0)
  • Discovery: JFrog Security Research Team

Vulnerability Summary

The Metro Development Server, which is opened by the React Native CLI, binds to external interfaces by default. The server exposes an endpoint (/open-url) that is vulnerable to OS command injection. This allows unauthenticated network attackers to send a POST request to the server and run arbitrary executables.

Impact

  • Remote Code Execution (RCE)
  • Command Injection
  • No Authentication Required
  • Network Accessible

Demo Structure

root@kitploit:~
react-native-cli-command-injection-demo/
├── README.md                    # This file
├── vulnerable-setup/
│   ├── package.json            # Vulnerable version setup
│   ├── metro.config.js         # Metro configuration
│   └── start-vulnerable.js     # Script to start vulnerable server
├── exploit-examples/
│   ├── basic-exploit.sh        # Basic command injection example
│   ├── windows-exploit.sh      # Windows-specific exploit
│   ├── advanced-exploit.py     # Advanced exploitation script
│   └── payload-examples.json   # Various payload examples
├── secure-setup/
│   ├── package.json            # Fixed version setup
│   ├── metro.config.js         # Secure configuration
│   └── start-secure.js         # Secure server startup
└── mitigation/
    ├── SECURITY.md             # Security recommendations
    └── host-binding-examples.sh # Host binding examples

Quick Start

1. Setup Vulnerable Environment

root@kitploit:~
cd vulnerable-setup
npm install
npm run start:vulnerable

2. Run Exploit

root@kitploit:~
cd exploit-examples
./basic-exploit.sh

3. Setup Secure Environment

root@kitploit:~
cd secure-setup
npm install
npm run start:secure

⚠️ IMPORTANT SECURITY NOTICE

This demonstration is for educational purposes only. Do not use these examples in production environments or against systems you do not own. Always follow responsible disclosure practices.

Links

  • JFrog Vulnerability Report
  • JFrog Technical Blog
  • Fix Commit
Download Tool