Metro4Shell: React Native Developers Face Critical Cross-Platform Attack

A new, dangerous threat is targeting developers who use React Native. Security researchers have discovered that a critical vulnerability in Metro, the default JavaScript bundler for React Native, is being actively exploited to deliver malicious payloads on both Windows and Linux systems. Dubbed Metro4Shell, this flaw allows attackers to execute arbitrary commands, bypass endpoint protections, and establish persistent access—all from seemingly innocuous development servers.

React Native is widely used for building cross-platform mobile applications, and Metro is essential during the development phase, handling tasks like bundling JavaScript and serving application assets. However, by default, Metro binds to external network interfaces and exposes certain HTTP endpoints intended only for local development. Attackers are now leveraging one of these endpoints—/open-url—to execute harmful commands remotely.

Discovered by JFrog in November 2025, the vulnerability affects versions 4.8.0 through 20.0.0-alpha.2 of @react-native-community/cli-server-api and was patched in version 20.0.0. Despite this fix, scans show that over 3,500 Metro servers remain exposed online, leaving developers and organizations vulnerable.

The attack works by sending POST requests to the exposed endpoint with a crafted URL payload. On Windows, this allows attackers to execute arbitrary OS commands; on Linux and macOS, it permits running executables with limited parameter control. Once executed, the payload disables endpoint protections—such as Microsoft Defender—establishes raw TCP connections to attacker infrastructure, downloads a second-stage binary, and runs it with attacker-supplied arguments.

VulnCheck, a vulnerability intelligence company, observed active exploitation starting December 21, 2025, with continued attacks into January 2026. Both Windows and Linux payloads were delivered, with the Windows binary written in Rust and packed with UPX, including basic anti-analysis measures. The same attacker infrastructure hosted a Linux counterpart, confirming a cross-platform attack strategy.

Despite these real-world exploits, the vulnerability’s EPSS (Exploit Prediction Scoring System) score remains low. Researchers warn that organizations cannot wait for inclusion in CISA KEV or vendor reports—they need immediate action to secure exposed development servers. VulnCheck has published indicators of compromise (IoCs) for both attacker infrastructure and payloads, helping defenders identify ongoing attacks.

What Undercode Say:

Metro4Shell exposes a worrying trend in developer-targeted attacks. Traditionally, development tools like Metro were considered low-risk because they operate in local environments. However, this exploit demonstrates that when development servers are bound to external interfaces, attackers can gain initial access without authentication, bridging the gap between development and production attacks.

The cross-platform nature of Metro4Shell is especially concerning. By delivering payloads for both Windows and Linux, attackers maximize the return on their effort, making every exposed server a potential launchpad. Rust-based binaries with UPX packing suggest attackers are focusing on evading static analysis and slowing incident response.

Even more alarming is the scale: 3,500 exposed servers is not a trivial number. Organizations may not even realize that their development environments are reachable from the internet. The persistence mechanisms—modifying Defender settings and writing executables to temporary directories—highlight that this is not just a proof-of-concept but a fully operational, sophisticated attack chain.

From a security hygiene perspective, Metro4Shell underscores the need for network segmentation and strict firewall rules. Development servers should never be exposed to the internet without robust access controls, VPNs, or authentication layers. Automated scanning for exposed endpoints, combined with patch management and monitoring for unusual outbound connections, could mitigate the risk significantly.

Developers also need to adopt a “secure by default” mindset. The vulnerability exploited unsanitized input to the open() function, a classic example of inadequate input validation. Code audits, dependency reviews, and runtime monitoring are essential tools to reduce the attack surface.

In broader terms, Metro4Shell illustrates a paradigm shift in supply-chain security. Attackers are increasingly moving from targeting production infrastructure to development environments where security controls are often weaker. This requires not just reactive patching but proactive developer education and secure CI/CD practices.

Finally, the relatively low EPSS score shows a potential flaw in current risk assessment frameworks—they may underestimate vulnerabilities that are easy to exploit on exposed development infrastructure. Security teams should combine EPSS insights with real-world threat intelligence to prioritize remediation efforts more accurately.

Fact Checker Results:

✅ Confirmed exposure: Metro4Shell affects @react-native-community/cli-server-api versions 4.8.0–20.0.0-alpha.2.

✅ Cross-platform impact: Both Windows and Linux payloads were actively observed in the wild.
❌ EPSS underestimation: Despite active exploitation, scoring frameworks like EPSS do not reflect the real risk to exposed development servers.

Prediction:

🔥 Metro4Shell may be the start of a new wave of development-targeted attacks, as attackers realize dev environments are easy targets.
⚡ Organizations exposing development servers without authentication will continue to see automated exploitation attempts.
💡 Expect future attacks to leverage more sophisticated payloads with multi-stage deployment, possibly extending to mobile emulators and CI/CD pipelines.

If you want, I can also create a visual flow diagram of the Metro4Shell attack chain that shows exactly how the payload propagates across Windows and Linux systems. This helps security teams understand and block it efficiently. Do you want me to make that?