Threat actors are exploiting a critical remote code execution vulnerability in React Native’s Metro development server to deploy sophisticated malware payloads targeting software developers worldwide.
The vulnerability, tracked as CVE-2025-11953 and nicknamed “Metro4Shell,” allows unauthenticated attackers to execute arbitrary operating system commands on developer machines through a simple crafted HTTP request.
Vulnerability Overview
CVE-2025-11953 carries a critical CVSS score of 9.8 and affects the widely used @react-native-community/cli npm package, which powers the Metro development server for React Native application development.
| CVE ID | CVSS Score | Vulnerability Type |
|---|---|---|
| CVE-2025-55182 | 10.0 (Critical) | Insecure Deserialization |
Security researchers at JFrog discovered the flaw stems from improper input validation on the Metro server’s /open-url endpoint, which directly passes user-controlled data to the unsafe open() function without sanitization.​
The Metro development server binds to all network interfaces (0.0.0.0) by default despite displaying a misleading “localhost:8081” message. This configuration exposes the vulnerable endpoint to any attacker on the same network.
On Windows systems, threat actors can achieve full command execution with complete parameter control, while macOS and Linux allow launching executable files with more limited options.
All versions of the @react-native-community/cli-server-api package from 4.8.0 through 20.0.0-alpha.2 are vulnerable, with patches available in version 20.0.0 and later.
Approximately 3,500 Metro servers remain exposed on the public internet, creating a significant attack surface for threat actors.
Active Exploitation Campaign
Cybersecurity firm VulnCheck first detected exploitation of Metro4Shell on December 21, 2025, through its Canary honeypot network.
The company observed consistent attacks delivering identical payloads on January 4 and January 21, 2026, indicating sustained operational use rather than experimental probing.
VulnCheck immediately added the vulnerability to its Known Exploited Vulnerabilities catalog, though CISA’s official KEV list and broader security community recognition lagged significantly behind the active exploitation timeline.
Attackers employ a multi-stage PowerShell-based loader delivered through cmd.exe with base64-encoded payloads.
The decoded PowerShell script performs a calculated attack sequence designed to evade endpoint security controls.
First, it adds Microsoft Defender exclusion paths for both the current working directory and Windows temporary directory using the Add-MpPreference cmdlet, ensuring subsequent malicious activities bypass antivirus detection.
The malware then establishes a raw TCP connection to attacker-controlled infrastructure and sends a GET /windows request to retrieve the next-stage payload.
The downloaded binary is written to the system’s temporary directory and executed with a large argument string.
Analysis revealed the payload as a UPX-packed Rust-based binary incorporating anti-analysis techniques, including runtime checks designed to hinder static inspection.
Threat Infrastructure and Indicators of Compromise
VulnCheck identified multiple attack sources and command-and-control servers associated with this campaign:
Exploitation Source IPs:
- 65.109.182.231
- 223.6.249.141
- 134.209.69.155
Payload Hosting Servers:
- 8.218.43.248:60124 (Windows payload)
- 47.86.33.195:60130 (Windows and Linux payloads)
The same infrastructure hosted corresponding “linux” binaries, demonstrating the cross-platform nature of this operation.
The Windows payload (SHA-256: d8337df3aff749250557bf11daf069eb404cce0e6f4f91c6bd6d3f78aed6e9d6) unpacks to reveal a Rust-based executable (SHA-256: 7ecbb0cc88dfa5f187c209a28bd25e8e2d5113bb898a91ae273bca5983130886) with sophisticated evasion capabilities.
The most critical aspect of this campaign is the temporal gap between initial exploitation and public awareness.
Despite active exploitation beginning in December 2025, the Exploit Prediction Scoring System (EPSS) continues to assign a low probability of only 0.00405 as of late January 2026, reflecting a dangerous disconnect between theoretical risk models and real-world threat activity.
Developer environments represent particularly attractive targets because they typically contain source code, credentials, API keys, and access to production infrastructure while receiving less security scrutiny than production systems.
The default insecure configuration of Metro binding to all interfaces while displaying localhost messages creates a false sense of security that leaves developers vulnerable on shared networks, coffee shops, or misconfigured corporate VLANs.
Follow us on Google News, LinkedIn, and X to Get Instant Updates and Set GBH as a Preferred Source in Google.
