Information has surfaced regarding a significant security hole that has been patched in the well-known “-react-native-community/cli” npm package. Under some circumstances, this flaw might be exploited to launch malicious operating system (OS) commands.
According to a report shared with The Hacker News by JFrog Senior Security Researcher Or Peles, the vulnerability poses a serious risk to developers because it makes it simple for remote unauthenticated attackers to initiate arbitrary OS command execution on the machine running react-native-community/cli’s development server.
With a CVSS score of 9.8 out of a possible 10.0, the vulnerability—tracked as CVE-2025-11953—indicates critical severity. Versions 4.8.0 through 20.0.0-alpha.2 of the “.react-native-community/cli-server-api” package are similarly impacted; version 20.0.0, which was released early last month, provides a patch.
Developers can create React Native mobile applications using the Meta-maintained command-line tools package read more about Critical React Native CLI Flaw Exposed Millions of Developers to Remote Attacks.
Get up to date on the latest cybersecurity news and enhance your knowledge of cybersecurity with our thorough coverage of the dangers, breaches, and solutions.