Full Breakdown
Exploitation of Metro4Shell Vulnerability in React Native CLI
2/4/2026, 4:50:47 AM
Overview of the Vulnerability
Cybersecurity researchers have identified a critical security flaw in the Metro Development Server, part of the "@react-native-community/cli" npm package, tracked as CVE-2025-11953, also known as Metro4Shell. This vulnerability, which has a CVSS score of 9.8, allows unauthenticated attackers to execute arbitrary operating system commands on affected systems. VulnCheck first observed exploitation of this flaw on December 21, 2025, and noted that the attacks have continued into January 2026.
Mechanism of Exploitation
The Metro Development Server, which is utilized by React Native, binds to external interfaces by default, exposing a command injection vulnerability. Attackers can send POST requests to execute arbitrary programs and, on Windows systems, run shell commands with fully controlled arguments. The exploitation process involves delivering a Base64-encoded PowerShell script that disables Microsoft Defender Antivirus protections and establishes a raw TCP connection to an attacker-controlled host. This connection is used to download and execute a Rust-based binary, which includes anti-analysis features to evade detection.
Persistence of Attacks
VulnCheck's analysis indicates that the attacks are not exploratory but operational, as the same infrastructure and techniques have been reused consistently over several weeks. The researchers highlighted that the lack of public acknowledgment of the vulnerability poses a risk, as many exposed servers remain online and vulnerable. Despite the ongoing exploitation, the flaw has not received significant attention, and its exploitation probability remains low according to the Exploit Prediction Scoring System (EPSS).
Network Infrastructure Involved
The attacks have been traced back to several IP addresses, including:
- 8.218.43.248 (payload host for Windows)
- 47.86.33.195 (payload host for both Windows and Linux)
Criticism of Public Awareness
Experts have criticized the gap between observed exploitation and public acknowledgment, warning that this disconnect can leave defenders unprepared for attacks. VulnCheck emphasized that the exploitation of vulnerabilities often begins before they are officially recognized, reinforcing the need for timely awareness and response measures.
Official Statements & Responses
VulnCheck stated, “CVE-2025-11953 is not remarkable because it exists. It is remarkable because it reinforces a pattern defenders continue to relearn. Development infrastructure becomes production infrastructure the moment it is reachable, regardless of intent.” This sentiment underscores the urgency for organizations to secure their development environments against such vulnerabilities.
Verbatim Quotes
- “CVE-2025-11953 is not remarkable because it exists. It is remarkable because it reinforces a pattern defenders continue to relearn. Development infrastructure becomes production infrastructure the moment it is reachable, regardless of intent.” — VulnCheck
- “This gap between observed exploitation and wider recognition matters, particularly for vulnerabilities that are easy to exploit and, as internet-wide search data shows, exposed on the public internet.” — VulnCheck
The ongoing exploitation of the Metro4Shell vulnerability highlights critical security concerns within the React Native ecosystem, necessitating immediate attention and action from developers and cybersecurity professionals.
