---
id: 6669
title: "Critical RCE Vulnerability CVE-2025-11953 Puts React Native Developers at Risk"
cve: CVE-2025-11953
source_domain: jfrog.com
source_url: "https://jfrog.com/blog/cve-2025-11953-critical-react-native-community-cli-vulnerability/"
published_at: "2025-11-04T14:15:18Z"
tags: ["rce", "supply-chain", "npm", "cve", "jfrog", "vulnerability-disclosure", "react", "react-native", "cve-2025-11953", "jfrog-com"]
phying_url: "https://phying.com/item/6669"
lang: en
---

# Critical RCE Vulnerability CVE-2025-11953 Puts React Native Developers at Risk

## Summary

JFrog discloses CVE-2025-11953 (CVSS 9.8): unauthenticated RCE in the @react-native-community/cli dev server lets attackers run OS commands; a related flaw exposes Metro to network attacks.

## Intelligence Metadata

- **Sources:** jfrog.com
- **CVE:** CVE-2025-11953
- **Published:** 2025-11-04T14:15:18Z
- **Original:** https://jfrog.com/blog/cve-2025-11953-critical-react-native-community-cli-vulnerability/
- **Phying News:** https://phying.com/item/6669