Metro4Shell
- Product
- React Native Community @react-native-community/cli-server-api (Metro development server)
- CVE
- CVE-2025-11953
- Disclosed
- 2025-11-04
- CVSS
- 9.8
- Auth
- pre-auth
- CISA KEV
- yes
- Affected
- @react-native-community/cli-server-api 4.8.0 through 20.0.0-alpha.2 (4.8.0-17.0.0: launch existing executables without arguments; 17.0.0+: full command execution)
- Fixed
- 20.0.0
Summary
JFrog found that the Metro dev server started by the React Native CLI listens on all network interfaces and exposes an unauthenticated /open-url endpoint whose input reaches the 'open' npm package. Anyone who can reach port 8081 can launch executables on the developer's machine, and on Windows run arbitrary shell commands. VulnCheck named it Metro4Shell after seeing in-the-wild exploitation from 21 December 2025.
Root cause
The /open-url POST handler passes the user-supplied url field to the 'open' npm package. On Windows, 'open' runs cmd /c start with the value and escapes only some metacharacters, allowing command injection. A second issue made the server bind to 0.0.0.0 by default despite printing 'localhost'.
Impact
Unauthenticated OS command execution on developer workstations and CI hosts running the Metro dev server.
Detection
Find listeners on TCP 8081 that answer as Metro; check node_modules for vulnerable cli-server-api versions; look for POST /open-url from non-local addresses. VulnCheck published IPs and payload hashes from observed attacks.
Mitigation
Upgrade to @react-native-community/cli 20.0.0+, and start Metro bound to 127.0.0.1 or behind a host firewall.