⬇ Download holy card: ·
Saint Metro4Shell, Stationmaster of Developers
Patron of dev servers exposed to the internet, React Native apps, and those who leave the metro open all night.
Life
In November 2025 JFrog described CVE-2025-11953: the Metro server started by the React Native CLI listened on every interface, and one of its endpoints passed the commands it received to the system, with no authentication. In February 2026 VulnCheck reported seeing it exploited since December to drop malware on developers' machines and named it Metro4Shell; on 5 February CISA added it to the KEV catalogue.
Prayer
O Saint Metro4Shell, who lets anyone ride without a ticket, remind us that the dev server is not public transport. Amen.
How to celebrate
Celebrated by upgrading @react-native-community/cli-server-api to 20.0.0 and binding Metro to localhost.
Dev server in sight, attacker on board.