id: CVE-2025-11953

info:
  name: "Reactnative - Command Injection"
  author: vedas-arpsyndicate
  severity: critical
  description: |
    The Metro Development Server, which is opened by the React Native Community CLI, binds to external interfaces
    by default. The server exposes an endpoint that is vulnerable to OS command injection.
  reference:
    - https://www.exploit.observer/?keyword=CVE-2025-11953&match=exact
    - https://subdomain.center/?engine=ammonites&keyword=reactnative&match=exact
  classification:
    cvss-metrics: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
    cvss-score: 9.8
    cve-id: CVE-2025-11953
    cwe-id: CWE-78
  metadata:
    verified: false
  tags: cve,cve2025,react-native,metro,rce,unauth,intrusive,kev,vkev,reactnative
flow: http(1) && http(2)

http:
  - raw:
      - |
        GET /status HTTP/1.1
        Host: {{Hostname}}

    matchers:
      - type: dsl
        dsl:
          - 'status_code == 200'
          - 'contains(body, "packager-status:running")'
          - 'contains(to_lower(header), "x-react-native-project-root")'
        condition: and
        internal: true

  - raw:
      - |
        POST /open-url HTTP/1.1
        Host: {{Hostname}}
        Content-Type: application/json

        {"url":"qmzyfc-probe://{{randstr}}"}

    matchers:
      - type: dsl
        dsl:
          - 'status_code == 200'
          - 'len(body) == 0'
          - '!contains(body, "Invalid URL")'
        condition: and