Hackers Exploit Metro4Shell RCE Flaw in React Native CLI npm Package

Metro4Shell RCE Flaw Exploitation

Threat actors have been observed exploiting a critical security flaw, CVE-2025-11953, impacting the Metro Development Server in the popular “@react-native-community/cli” npm package, with the first exploitation observed by VulnCheck on December 21, 2025. The vulnerability, also known as Metro4Shell, allows remote unauthenticated attackers to execute arbitrary operating system commands on the underlying host, posing a significant risk to development infrastructure.

Why This Matters

The exploitation of Metro4Shell highlights the technical reality that development infrastructure can become production infrastructure the moment it is reachable, regardless of intent, leading to significant security risks if not properly secured. The ideal model of separating development and production environments is often not followed in practice, resulting in vulnerabilities like Metro4Shell being exploited, with potential costs including data breaches, malware deployment, and disruption of services.

Key Insights

• CVE-2025-11953 has a CVSS score of 9.8, indicating a critical security flaw: VulnCheck, 2025
• The vulnerability allows remote unauthenticated attackers to execute arbitrary operating system commands, enabling the deployment of malware like the Rust-based binary used in the observed attacks: JFrog, 2025
• The “@react-native-community/cli” npm package is widely used in React Native development, increasing the potential impact of the vulnerability: npm, 2026

Working Example

# Example of how to check for the vulnerability
npm audit "@react-native-community/cli"

# Example of how to update the package to a secure version
npm update "@react-native-community/cli"

Practical Applications

• Use Case: Companies like Facebook and Instagram, which use React Native, should ensure their development infrastructure is properly secured and updated to prevent exploitation of the Metro4Shell vulnerability.
• Pitfall: Failing to separate development and production environments, or not regularly updating dependencies, can lead to the exploitation of vulnerabilities like Metro4Shell, resulting in significant security breaches and financial losses.

References:

• http://thehackernews.com/2026/02/hackers-exploit-metro4shell-rce-flaw-in.html
• https://www.npmjs.com/package/@react-native-community/cli
• https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2025-11953