Millions of Developers Could Be Open to Attack After Critical Flaw Exploited - Here's What We Know

Why It Matters

The flaw opens a direct path for remote code execution in millions of mobile development projects, highlighting the broader risk of third‑party supply‑chain components and the need for automated security scanning. Failure to remediate could lead to widespread compromise of developer environments and downstream applications.

Summary

A critical‑severity flaw (CVE‑2025‑11953) was discovered in the @react-native-community/cli npm package, which powers the Metro development server for React Native apps. The vulnerability enables unauthenticated OS command injection via a POST request, allowing attackers to run arbitrary binaries on Windows, Linux or macOS. It affects versions 4.8.0 through 20.0.0‑alpha.2 and has been patched in version 20.0.0, but the package sees up to two million downloads per week, exposing a large developer base. Experts advise restricting network exposure of the Metro server until updates are applied.