React Native CLI
72%
Total Score
caution
Usable with caveats: maintenance is concentrated and GitHub Actions need tighter pinning.
All recent commits came from one contributor. Organization ownership provides some handoff capacity, but no second recently active contributor is shown to reduce concentration risk.
Only one commit was recorded in the last three months, showing limited recent direct commit activity despite the recent registry release.
The repository continues to receive issues and pull requests, although only one pull request was merged in the last month, suggesting some review backlog.
The project uses TypeScript, Babel, and npm build tooling, but no repository security-scanning tool was detected, leaving a modest transparency gap.
The repository has no published security policy, making vulnerability reporting and response expectations less transparent for a widely used CLI.
| Title | Versions | Severity |
|---|---|---|
CVE-2025-11953 @react-native-community/cli is vulnerable to Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection') in versions 20.0.0-alpha.0 - 20.0.0, 19.0.0-alpha.0 - 19.1.2 and 18.0.0 - 18.0.1. | 18.0.0 - 18.0.119.0.0-alpha.0 - 19.1.220.0.0-alpha.0 - 20.0.0 | Critical |
| Dependency | Last Release | Score |
|---|---|---|
execa Version ^5.0.0 | — | — |
semver Version ^7.5.2 | — | — |
find-up Version ^5.0.0 | — | — |
prompts Version ^2.4.2 | — | — |
fs-extra Version ^8.1.0 | — | — |
Connect your repositories to instantly see whether vulnerable or malicious packages exist in your codebase.
Free. No credit card required.

I consent to receiving marketing communications based on Aikido’s Privacy Policy.
SOC 2Compliant
ISO 27001Compliant
ISO 42001Compliant© All Intel data is openly available and commercially licensed.