Command injection in React Native Community CLI allows remote attackers to perform remote code execution by sending HTTP requests

The React Native Community CLI opens a development server that accepts commands from anyone on the network without checking who they are. An attacker can send a specially crafted request to run any program on the developer's computer, potentially stealing data or installing malware.

The Metro Development Server binds to external interfaces by default and exposes an endpoint vulnerable to OS command injection (CWE-78). Unauthenticated network attackers can send POST requests to execute arbitrary executables; on Windows, this extends to arbitrary shell commands with full argument control. The attack requires network access to the development server but no authentication.