Executive Summary
VulnCheck has identified active, operational exploitation of CVE-2025-11953, dubbed "Metro4Shell," targeting React Native Metro Development Servers exposed to the public internet. Initial activity was detected as early as December 2025, with continued campaigns through January 2026. This vulnerability allows for unauthenticated remote code execution via the `/open-url` endpoint on Windows systems when the development server is bound to external interfaces.
The attack chain involves a multi-stage process where initial access is gained via a POST request, followed by base64-encoded PowerShell loaders that disable security controls and fetch Rust-based binaries. The payloads are UPX-packed and employ anti-analysis techniques. This campaign is particularly significant because it targets developer infrastructure, which is often less monitored than production environments but provides a potent entry point for broader organizational compromise.
Organizations using React Native should immediately verify that Metro servers are not exposed to the public internet and ensure development tools are included in vulnerability management and monitoring programs.