Threat actors are actively exploiting a critical remote code execution vulnerability in React Native’s Metro development server to deploy sophisticated malware targeting software developers worldwide.
The vulnerability, tracked as CVE-2025-11953 and nicknamed “Metro4Shell,” allows unauthenticated attackers to execute arbitrary operating system commands on developer machines by sending specially crafted HTTP requests.
Security researchers at JFrog discovered the flaw stems from improper input validation on the Metro server’s /open-url endpoint, which directly passes user-controlled data to the unsafe open() function without sanitization.
The vulnerability affects the widely used @react-native-community/cli npm package across all versions from 4.8.0 through 20.0.0-alpha.2.
The Metro development server binds to all network interfaces (0.0.0.0) by default, despite displaying a misleading “localhost:8081” message, which exposes the vulnerable endpoint to any attacker on the same network.
On Windows systems, threat actors achieve full command execution with complete parameter control, while macOS and Linux variants allow launching executable files with more limited options.
Patches are available in version 20.0.0 and later, with approximately 3,500 Metro servers remaining exposed on the public internet.
Vulnerability Details
Cybersecurity firm VulnCheck first detected exploitation of Metro4Shell on December 21, 2025, through its Canary honeypot network.
The company observed consistent attacks delivering identical payloads on January 4 and January 21, 2026, indicating sustained operational use rather than experimental probing.
This represents a critical concern: active exploitation began in December 2025, yet the Exploit Prediction Scoring System (EPSS) assigns only a 0.00405 probability score as of late January 2026, a dangerous disconnect between theoretical risk models and real-world threat activity.
Active Exploitation Campaign & Indicators of Compromise
Attackers employ a multi-stage PowerShell-based loader delivered through cmd.exe with base64-encoded payloads.
The decoded script performs a calculated attack sequence: first, it adds Microsoft Defender exclusion paths for both the current working directory and the Windows temporary directory using the Add-MpPreference cmdlet, bypassing antivirus detection.
The malware then establishes a raw TCP connection to the attacker-controlled infrastructure and sends a GET /windows request to retrieve the next-stage payload, which is written to the system’s temporary directory and executed with a large argument string.
Analysis revealed the payload as a UPX-packed Rust-based binary incorporating sophisticated anti-analysis techniques, including runtime checks designed to hinder static inspection.
VulnCheck identified multiple attack sources and command-and-control infrastructure:
Exploitation Source IPs:
- 65.109.182.231
- 223.6.249.141
- 134.209.69.155
Payload Hosting Servers:
- 8.218.43.248:60124 (Windows payload)
- 47.86.33.195:60130 (Windows and Linux payloads)
The Windows payload (SHA-256:Â d8337df3aff749250557bf11daf069eb404cce0e6f4f91c6bd6d3f78aed6e9d6) unpacks to reveal a Rust-based executable (SHA-256:Â 7ecbb0cc88dfa5f187c209a28bd25e8e2d5113bb898a91ae273bca5983130886) with advanced evasion capabilities.
The identical infrastructure hosting corresponding “Linux” binaries demonstrates the cross-platform scope of this operation.
Developer environments represent particularly attractive targets because they typically contain source code, credentials, API keys, and access to production infrastructure while receiving substantially less security scrutiny than production systems.
The default insecure Metro configuration creates a false sense of security, leaving developers vulnerable on shared networks, coffee shops, or misconfigured corporate VLANs.
Organizations should immediately audit their development environments, update all @react-native-community/cli packages to version 20.0.0 or later, restrict Metro server binding to localhost only, and implement network segmentation to limit exposure on untrusted networks.
Follow us on Google News , LinkedIn and X to Get More Instant Updates. Set Cyberpress as a Preferred Source in Google.
%20(1).webp?fit=1600,900&ssl=1&description=The vulnerability, tracked as CVE-2025-11953 and nicknamed "Metro4Shell," allows unauthenticated attackers to execute arbitrary operating system commands on developer machines by sending specially crafted HTTP requests.){kind=link}