CVE-2025-11953 (Metro4Shell) in React Native Metro Server Enables RCE

Back Socradar

CVE-2025-11953 (Metro4Shell) in React Native Metro Server Enables RCE

Socradar • February 4, 2026

Share: View original

Tracked as CVE -2025-11953 and also referred to as Metro4Shell, the vulnerability allows unauthenticated operating system command execution...

The full story

This article is one source in a clustered incident — the cluster page carries the summary, timeline and every other outlet covering it.

CVE-2025-11953: Remote Code Execution Vulnerability in React Native Metro Server A critical unauthenticated remote code execution (RCE) vulnerability, tracked as CVE-2025-11953 and known as Metro4Shell, has been identified in the React Native Metro development server. This vulnerability allows attackers to execute operating system commands without authentication, affecting users of the React Native framework. The vulnerability was added to the CISA KEV list for active exploitation on February 5, 2026. 2 sources 53

Extracted Entities

APT Groups (1)

Attack Types (1)

Zero-day Exploit

CVEs (1)

Platforms (1)

React Native Metro Server