Do Son VulnCheck reveals CVE-2025-11953 (Metro4Shell) was exploited in the wild since Dec 2025. Attackers target Windows & Linux dev servers. Patch now.
CVE-2025-11953
A Critical RCE flaw (CVE-2025-11953, CVSS 9.8) in React Native Community CLI allows unauthenticated attackers to execute arbitrary code via a command injection in the exposed Metro Dev Server.