Phying News
P非影 中文
Curated security research, vulnerabilities, advisories and tools for practitioners.

Critical RCE Vulnerability CVE-2025-11953 Puts React Native Developers at Risk

jfrog.com | research | CVE-2025-11953 | #rce | #supply-chain | #npm | #jfrog | #vulnerability-disclosure | #react-native | #cve-2025-11953

Summary

JFrog discloses CVE-2025-11953 (CVSS 9.8): unauthenticated RCE in the @react-native-community/cli dev server lets attackers run OS commands; a related flaw exposes Metro to network attacks.
Published
Collected

original ↗

Related coverage

  1. From DEF CON Research to Automated Supply Chain Defense, finding npx confusion vulnerabilities with npxconfuse (lab.ctbb.show)
  2. Extending the Single Source of Truth to the Agentic Software Supply Chain (jfrog.com)
  3. Live From the Show Floor: swampUP 2026 (jfrog.com)
  4. DevGovOps: How the AI Era Dictates That Governance Lives inside the Pipeline (jfrog.com)
  5. Every New Compliance Framework Restarts the Same Fire Drill. It Doesn’t Have To. (jfrog.com)
  6. Coding Agents Just Reopened Your Software Supply Chain Blind Spot (jfrog.com)

back