Attackers are actively exploiting a critical vulnerability in React Native’s Metro server to infiltrate development environments. The vulnerability, CVE-2025-11953, allows malicious actors to execute code on Windows and Linux systems via exposed development servers.
Metro is React Native’s default JavaScript bundler during application development and testing. In many configurations, this server runs locally, but by default, Metro can also bind to external network interfaces. This makes HTTP endpoints available that are intended for development. It is precisely this functionality that now constitutes an attack vector, reports BleepingComputer.
Researchers discovered that the /open-url endpoint accepts POST requests with a supplied URL that is passed on to an internal function without being checked. This allows an attacker on Windows to execute arbitrary system commands without authentication. On Linux and macOS, it is possible to launch executable files, with limited control over parameters.
The issue affects versions of @react-native-community/cli-server-api from 4.8.0 through 20.0.0-alpha.2. The vulnerability has been fixed in version 20.0.0 and newer, but many development environments appear to still be vulnerable.
Shortly after the announcement, several proof-of-concept exploits appeared. Subsequently, a threat actor was observed actually exploiting the vulnerability. The same attack technique was used on multiple occasions, with identical payloads targeting Windows and Linux.
In these attacks, a base64-encoded PowerShell payload is hidden in the body of an HTTP POST request to an exposed Metro endpoint. After decoding, the payload disables security by adding exceptions to Microsoft Defender for the working directory and the temporary directory. It then establishes a TCP connection to the attacker’s infrastructure, from which additional malware is retrieved.
The files are stored in the temporary folder and executed immediately with a long series of parameters. The Windows variant is written in Rust and compressed with UPX, using simple techniques to hinder analysis. A Linux binary was also found on the same servers, indicating that both platforms are targeted.
Thousands of Metro servers accessible
According to recent scans, thousands of Metro servers worldwide are accessible via the internet. These are often development environments that were never intended to be public. This makes this vulnerability attractive, because development systems are often less strictly secured and still have access to source code, keys, and internal networks.
It is striking that, despite active exploitation, the vulnerability scores low in the Exploit Prediction Scoring System, which assesses the likelihood of abuse. Researchers emphasize that organizations should not be guided by such scores and should not wait for official lists before taking action.
The study published indicators of compromise that organizations can use to check whether systems have been exploited. Given the simplicity of the attack and the large number of exposed servers, this vulnerability remains attractive to attackers targeting developers and their environments.
Also read: Vulnerable AI platform n8n: full control over instances possible