CVE-2025-11953 – Metro4Shell RCE in React Native Metro Server

Back Indusface

CVE-2025-11953 – Metro4Shell RCE in React Native Metro Server

Indusface • February 6, 2026

Share: View original

A critical unauthenticated remote code execution ( RCE ) vulnerability has been identified in the React Native Metro development server, ...

The full story

This article is one source in a clustered incident — the cluster page carries the summary, timeline and every other outlet covering it.

CVE-2025-11953: Remote Code Execution Vulnerability in React Native Metro Server A critical unauthenticated remote code execution (RCE) vulnerability, tracked as CVE-2025-11953 and known as Metro4Shell, has been identified in the React Native Metro development server. This vulnerability allows attackers to execute operating system commands without authentication, affecting users of the React Native framework. The vulnerability was added to the CISA KEV list for active exploitation on February 5, 2026. 2 sources 53

Extracted Entities

APT Groups (1)

Attack Types (1)

Zero-day Exploit

CVEs (1)

MITRE ATT&CK (1)

T1203 - Exploitation for Client Execution

Platforms (1)

React Native Metro Server