Detect React Native Community CLI OS Command Injection (CVE-2025-11953) in CrowdStrike LogScale
Detects exploitation of CVE-2025-11953, an OS command injection vulnerability (CWE-78) in the React Native Community CLI. An attacker who can influence arguments or configuration consumed by the React Native CLI can inject arbitrary OS commands that execute with the privileges of the developer or CI/CD process invoking the CLI. This vulnerability is listed in the CISA Known Exploited Vulnerabilities catalog.
MITRE ATT&CK
- Tactic
- Execution Persistence Lateral Movement
LogScale Detection Query
event_simpleName=ProcessRollup2
| filter (CommandLine = "*react-native*" OR CommandLine = "*@react-native-community*" OR ParentCommandLine = "*react-native*")
| filter CommandLine = "*[;&|`$()]*"
| filter (CommandLine = "*curl *" OR CommandLine = "*wget *" OR CommandLine = "*bash -i*" OR CommandLine = "*sh -c*" OR CommandLine = "*powershell*" OR CommandLine = "*cmd /c*" OR CommandLine = "*/dev/tcp*" OR CommandLine = "* nc *" OR CommandLine = "*ncat *")
| eval InjectionType=case(
CommandLine="*curl *" OR CommandLine="*wget *", "RemoteDownload",
CommandLine="*bash -i*" OR CommandLine="*sh -c*", "ShellEscape",
CommandLine="*powershell*" OR CommandLine="*cmd /c*", "WindowsShell",
CommandLine="*/dev/tcp*" OR CommandLine="* nc *" OR CommandLine="*ncat *", "ReverseShell",
true(), "MetacharInjection"
)
| table timestamp, ComputerName, UserName, FileName, CommandLine, ParentCommandLine, InjectionType
| sort -timestampCrowdStrike Falcon Query Language detection for ProcessRollup2 events where the React Native Community CLI command line includes OS command injection metacharacters combined with shell or network utilities.
Data Sources
Required Tables
False Positives & Tuning
- Falcon-monitored CI/CD build hosts running legitimate react-native mobile build pipelines with shell chaining.
- Developer workstations where npm scripts wrap react-native CLI in shell commands.
- Security engineering teams running react-native CLI tooling alongside penetration testing utilities.
- Enterprise mobile development environments using custom build orchestration that invokes react-native with complex arguments.
Other platforms for CVE-2025-11953
Testing Methodology
Validate this detection against 4 adversary techniques from Atomic Red Team. Each test below lists the behaviour to exercise and the telemetry you should expect to see. Executable commands and cleanup steps are available with Pro.
- Test 1Command Injection via React Native CLI project name argument
Expected signal: Process create event showing node spawning sh or bash with a command line containing the injected semicolon-delimited id command; file creation event for /tmp/cve_2025_11953_poc.txt.
- Test 2Reverse shell injection via React Native CLI on Linux
Expected signal: Process create events for node → sh → id; file write to /tmp/rn_inject_test.txt containing the output of id.
- Test 3Remote payload download via injected curl in React Native CLI build context
Expected signal: Process create event for node spawning sh, which spawns curl with an external URL argument; network connection event for curl to destination host.
- Test 4Windows PowerShell injection via React Native CLI on Windows
Expected signal: Sysmon Event ID 1 showing node.exe spawning cmd.exe which spawns powershell.exe; file creation event in %TEMP% for rn_inject_test.txt.
Response Playbook
Triage
- Identify the host, user account, and exact command line where the React Native Community CLI was invoked; determine whether the user is a legitimate developer or an automated CI/CD service account.
- Correlate the suspicious process tree: capture the parent PID chain from the CLI invocation down to any spawned shells or network utilities to establish whether injection actually succeeded or was blocked.
- Check package.json, .npmrc, and any CI configuration files on the affected host for malicious modifications to scripts, dependencies, or environment variable overrides that could have introduced the injected payload.
- Review network connections initiated by child processes of the react-native CLI around the time of the alert to determine whether data exfiltration or C2 callback occurred.
Containment
- Immediately isolate the affected developer workstation or CI/CD runner from the network if active exploitation (reverse shell, exfiltration) is confirmed; revoke any tokens, SSH keys, or cloud credentials accessible from that environment.
- Freeze and snapshot the compromised Node.js/npm environment (node_modules, package-lock.json, yarn.lock) to preserve forensic state, then block the offending CLI version from executing in CI/CD pipelines until the React Native Community CLI is patched or replaced.
Evidence Collection
- Collect full process tree logs (parent/child PIDs, command lines, environment variables) from the host's EDR or Sysmon logs covering at least 30 minutes before and after the alert timestamp.
- Preserve network capture (PCAP or flow records) for all outbound connections from the affected host in the alert window, focusing on non-standard ports or connections to external IPs initiated by node, sh, bash, or curl child processes.
Escalation Criteria
- !Escalate to IR if any child process of the react-native CLI successfully established an outbound connection to an external IP or DNS name not in the organization's approved CI/CD infrastructure list.
- !Escalate immediately if secrets (API keys, signing certificates, cloud credentials, Vault tokens) accessible from the developer or CI/CD environment may have been exposed to the injected command context.
Investigation Guide
Related Techniques
Forensic Artifacts
- >
npm debug logs at ~/.npm/_logs/ and project-level npm-debug.log containing CLI invocation arguments and spawned subprocess output. - >
Shell history files (~/.bash_history, ~/.zsh_history) on developer machines recording the exact react-native CLI invocation sequence. - >
CI/CD pipeline logs (GitHub Actions, Jenkins, CircleCI) preserving environment variables, command outputs, and exit codes for the affected build job. - >
Sysmon Event ID 1 (Process Create) and Event ID 3 (Network Connection) records capturing child process spawns and outbound connections from node.exe or node.
Tuning Guidance
Start by scoping the detection to hosts or service accounts where the React Native Community CLI is known to be installed (developer workstations, mobile CI/CD runners). Suppress alerts for shell invocations that match a documented allowlist of legitimate npm lifecycle scripts (e.g., fastlane, gradlew). Increase confidence to HIGH for any alert where the child process makes an outbound network connection. Lower alert priority for internal CI/CD hosts with static, version-pinned CLI installations until the patched version is confirmed deployed.
Hunting Queries
Hunt for recurring patterns where a Node.js process (likely react-native CLI) spawns interactive shell processes, which may indicate persistent exploitation or backdoor establishment across the environment.
DeviceProcessEvents
| where TimeGenerated > ago(30d)
| where (ProcessCommandLine has 'react-native' or ParentProcessName has 'node')
| where FileName in ('sh', 'bash', 'zsh', 'dash', 'cmd.exe', 'powershell.exe', 'pwsh.exe')
| summarize count() by DeviceName, AccountName, FileName, ProcessCommandLine
| where count_ > 2
| order by count_ descindex=* (sourcetype=syslog OR sourcetype="xmlwineventlog:microsoft-windows-sysmon/operational")
| where match(parent_process, "(?i)node") AND match(process, "(?i)(sh|bash|zsh|cmd|powershell)")
| stats count by host, user, parent_process, process, cmdline
| where count > 2
| sort -countAtomic Red Team Tests
Simulates injection of a shell command through a CLI argument that is unsafely passed to exec/spawn in the React Native Community CLI, as would occur via CVE-2025-11953.
Command
node -e "const {execSync} = require('child_process'); execSync('npx @react-native-community/cli init \"TestApp; id > /tmp/cve_2025_11953_poc.txt\"', {stdio: 'inherit', shell: true});"Cleanup
rm -f /tmp/cve_2025_11953_poc.txtExpected Telemetry
Process create event showing node spawning sh or bash with a command line containing the injected semicolon-delimited id command; file creation event for /tmp/cve_2025_11953_poc.txt.
Expected Detection
Alert fires on shell metacharacter (;) in react-native CLI argument combined with shell child process spawn.
Simulates an attacker injecting a bash reverse-shell payload into a CLI argument to establish C2 callback, demonstrating the impact of CVE-2025-11953 in a CI/CD context.
Command
node -e "const {execSync} = require('child_process'); try { execSync('echo \"injected: $(id)\" > /tmp/rn_inject_test.txt', {shell: true}); } catch(e) {}"Cleanup
rm -f /tmp/rn_inject_test.txtExpected Telemetry
Process create events for node → sh → id; file write to /tmp/rn_inject_test.txt containing the output of id.
Expected Detection
Alert fires on $() subshell in node process command line combined with sh child process.
Simulates an attacker leveraging CVE-2025-11953 to download a remote payload during CLI invocation, representing a supply-chain or CI/CD pipeline compromise scenario.
Command
node -e "const {execSync} = require('child_process'); try { execSync('echo react-native-cli-context && curl -s -o /tmp/rn_dl_test.txt http://127.0.0.1:9999/payload 2>/dev/null || echo download_attempted', {shell: true}); } catch(e) { require('fs').writeFileSync('/tmp/rn_dl_test.txt', 'attempted'); }"Cleanup
rm -f /tmp/rn_dl_test.txtExpected Telemetry
Process create event for node spawning sh, which spawns curl with an external URL argument; network connection event for curl to destination host.
Expected Detection
Alert fires on react-native CLI context process spawning curl with remote URL, matching RemoteDownload injection pattern.
Simulates CVE-2025-11953 exploitation on a Windows developer workstation where an injected argument causes the CLI to spawn PowerShell.
Command
node -e "const {execSync} = require('child_process'); try { execSync('echo react-native-cli & powershell -Command \"Get-Date | Out-File $env:TEMP\\rn_inject_test.txt\"', {shell: true}); } catch(e) {}"Cleanup
powershell -Command "Remove-Item $env:TEMP\rn_inject_test.txt -ErrorAction SilentlyContinue"Expected Telemetry
Sysmon Event ID 1 showing node.exe spawning cmd.exe which spawns powershell.exe; file creation event in %TEMP% for rn_inject_test.txt.
Expected Detection
Alert fires on react-native CLI Windows shell injection pattern matching & metacharacter combined with powershell child process.