[GHSA-399j-vxmf-hjvr] @react-native-community/cli has arbitrary OS command injection

[cylewaitforit]

Updates

• Affected products

Comments
https://x.com/SzymonRybczak/status/1986199665000566848

[Copilot]

Pull Request Overview

This PR corrects the vulnerability version range in a GitHub security advisory by specifying that the vulnerability was introduced in version 18.0.0 rather than affecting all versions from "0". This narrows the scope of affected versions to 18.0.0-19.x.x (fixed in 20.0.0).

Key Changes:

• Updated the introduced version from "0" to "18.0.0" to accurately reflect when the vulnerability was introduced
• Updated the modified timestamp to reflect the advisory correction

---

💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.

[advisory-database]

Hi @cylewaitforit! Thank you so much for contributing to the GitHub Advisory Database. This database is free, open, and accessible to all, and it's people like you who make it great. Thanks for choosing to help others. We hope you send in more contributions in the future!

[shelbyc]

Hi @cylewaitforit, I noticed from https://x.com/SzymonRybczak/status/1986199665000566848 that https://github.com/react-native-community/cli has released multiple fixes to address CVE-2025-11953, including 19.1.2, 18.0.1, and 17.0.1. I'm changing the affected version ranges to incorporate these fixed versions. Because you alerted me to the existence of backported fixes, you'll still receive credit on the advisory.