Bleepingcomputer

Hackers Exploit React Native Metro Vulnerability to Target Developers

First seen 3 Feb 2026, 19:24 UTC • Bleepingcomputer

+5 •57.2

Article Content

Include sub-articles 1 / 1

Browse articles

ThreatCluster

Hackers are exploiting the critical vulnerability CVE-2025-11953 in the Metro server for React Native, affecting developers on Windows, Linux, and macOS. The vulnerability allows unauthenticated attackers to execute arbitrary OS commands on Windows and run arbitrary executables on Linux and macOS with limited control. This poses a significant risk to development environments using React Native.

How this analysis works

Attack Flow

24 entities, 35 inferred relationships (STIX 2.1).

Threat Actor (1)

Metro4Shell

Technique (5)

Malware
Zero-day Exploit
T1059.001 - PowerShell
T1059.003 - Windows Command Shell
T1059 - Command and Scripting Interpreter

Organization (1)

JFrog

Vulnerability (2)

CVE-2025-11953
CVE-2025-55182

Indicator (4)

134.209.69.155
223.6.249.141
47.86.33.195
65.109.182.231

Affected Platform (7)

Linux
MacOS
Metro Development Server
React Native Community Command Line Tool
React Native Metro Server
React Server Components
Windows

Tool (4)

React Native
Cmd.exe
PowerShell
Windows Command Shell

Relationships

Metro4Shell uses React Native
Metro4Shell uses Cmd.exe
Metro4Shell uses PowerShell
Metro4Shell uses Windows Command Shell
Metro4Shell uses Malware
Metro4Shell uses Zero-day Exploit
Metro4Shell uses T1059.001 - PowerShell
Metro4Shell uses T1059.003 - Windows Command Shell
Metro4Shell uses T1059 - Command and Scripting Interpreter
Metro4Shell exploits CVE-2025-11953
Metro4Shell exploits CVE-2025-55182
React Native exploits CVE-2025-11953
React Native exploits CVE-2025-55182
Cmd.exe exploits CVE-2025-11953
Cmd.exe exploits CVE-2025-55182
PowerShell exploits CVE-2025-11953
PowerShell exploits CVE-2025-55182
Windows Command Shell exploits CVE-2025-11953
Windows Command Shell exploits CVE-2025-55182
CVE-2025-11953 targets Linux
CVE-2025-11953 targets MacOS
CVE-2025-11953 targets Metro Development Server
CVE-2025-11953 targets React Native Community Command Line Tool
CVE-2025-55182 targets Linux
CVE-2025-55182 targets MacOS
CVE-2025-55182 targets Metro Development Server
CVE-2025-55182 targets React Native Community Command Line Tool
Metro4Shell targets JFrog
Metro4Shell related to 134.209.69.155
Metro4Shell related to 223.6.249.141
Metro4Shell related to 47.86.33.195
Metro4Shell related to 65.109.182.231
Metro4Shell related to React Native Metro Server
Metro4Shell related to React Server Components
Metro4Shell related to Windows

Hackers Exploit React Native Metro Vulnerability to Target Developers

Article Content

More articles in this cluster

Attack Flow

Defensive Countermeasures

Extracted Entities

Continue Reading