react-native-community
fix: RCE vulnerability from CVE-2025-11953
Summary
Continuation of the fix that landed in https://github.com/react-native-community/cli/commit/15089907d1f1301b22c72d7f68846a2ef20df547, that prevents RCE using a spoofed URL with | character, such as: https://evil.com?|calc.exe.
cc @633kh4ck @mbaraniak-exodus
@thymikee,
The fix seems reasonable, unless you switch in the future to a new version of open, which uses PS underneath. Then you will need escape also $ (, etc.
Be aware of (non-default) delayed expansion, which will make such syntax possible !VAR!
For posterity: this is likely still fragile, but better than it was.
On a side note, this can (still) be exploited to exfiltrate some environment variables; possibilities are more limited, though. For example, https://example.com/?a=%¾TA% is encoded to https://example.com/?a=%25%C2%BETA%25 (note %BETA%).
