漏洞描述
The Metro development server started by the React Native Community CLI binds to external network interfaces by default and exposes an unauthenticated /open-url endpoint. Affected versions pass the attacker supplied url value straight to the open() helper without validating the scheme, allowing an unauthenticated attacker to launch arbitrary executables on the developer machine. On Windows the request is dispatched through cmd, which permits arbitrary shell commands with fully controlled arguments. The fix was released as a backport across several release lines, so the version number alone does not indicate whether an instance is affected, and this template probes the endpoint behaviour instead.
影响产品
暂无结构化产品信息。
修复建议
建议关注厂商安全公告，及时升级至已修复版本，并结合实际资产暴露情况采取缓解措施。