
CVE-2025-11953 demonstration: Critical RCE vulnerability in React Native CLI (CVSS 9.8). Educational security research with proof-of-concept exploits and mitigation strategies.
JFSA-2025-001495618 - Critical Command Injection in React Native CLI
The Metro Development Server, which is opened by the React Native CLI, binds to external interfaces by default. The server exposes an endpoint (/open-url) that is vulnerable to OS command injection. This allows unauthenticated network attackers to send a POST request to the server and run arbitrary executables.
react-native-cli-command-injection-demo/
├── README.md # This file
├── vulnerable-setup/
│ ├── package.json # Vulnerable version setup
│ ├── metro.config.js # Metro configuration
│ └── start-vulnerable.js # Script to start vulnerable server
├── exploit-examples/
│ ├── basic-exploit.sh # Basic command injection example
│ ├── windows-exploit.sh # Windows-specific exploit
│ ├── advanced-exploit.py # Advanced exploitation script
│ └── payload-examples.json # Various payload examples
├── secure-setup/
│ ├── package.json # Fixed version setup
│ ├── metro.config.js # Secure configuration
│ └── start-secure.js # Secure server startup
└── mitigation/
├── SECURITY.md # Security recommendations
└── host-binding-examples.sh # Host binding examples
cd vulnerable-setup
npm install
npm run start:vulnerable
cd exploit-examples
./basic-exploit.sh
cd secure-setup
npm install
npm run start:secure
This demonstration is for educational purposes only. Do not use these examples in production environments or against systems you do not own. Always follow responsible disclosure practices.