Track vulnerabilities like this one.
Sign up free to get alerted when software you use is affected.
react-native-community CLI may allow code execution
published 1 month ago
Summary
The command‑line tools used with React Native apps could be tricked into running unwanted code, which might let an attacker control the system. Update to version 12.3.6‑tuxcare.1 (or later) to close this gap. Apply the security update as soon as possible to keep your development environment safe.
What to do
- Update react-native-community @react-native-community/cli to version 12.3.6-tuxcare.1.
- Update react-native-community @react-native-community/cli-clean to version 12.3.6-tuxcare.1.
- Update react-native-community @react-native-community/cli-config to version 12.3.6-tuxcare.1.
- Update react-native-community @react-native-community/cli-debugger-ui to version 12.3.6-tuxcare.1.
- Update react-native-community @react-native-community/cli-doctor to version 12.3.6-tuxcare.1.
- Update react-native-community @react-native-community/cli-hermes to version 12.3.6-tuxcare.1.
- Update react-native-community @react-native-community/cli-platform-android to version 12.3.6-tuxcare.1.
- Update react-native-community @react-native-community/cli-platform-ios to version 12.3.6-tuxcare.1.
- Update react-native-community @react-native-community/cli-plugin-metro to version 12.3.6-tuxcare.1.
- Update react-native-community @react-native-community/cli-server-api to version 12.3.6-tuxcare.1.
- Update react-native-community @react-native-community/cli-tools to version 12.3.6-tuxcare.1.
- Update react-native-community @react-native-community/cli-types to version 12.3.6-tuxcare.1.
Affected software
| Ecosystem | Vendor | Product | Affected versions |
|---|---|---|---|
| TuxCare:npm | react-native-community | @react-native-community/cli |
< 12.3.6-tuxcare.1 >= 12.3.6-tuxcare.0, < 12.3.6-tuxcare.1 Fix: upgrade to 12.3.6-tuxcare.1
|
| TuxCare:npm | react-native-community | @react-native-community/cli-clean |
< 12.3.6-tuxcare.1 >= 12.3.6-tuxcare.0, < 12.3.6-tuxcare.1 Fix: upgrade to 12.3.6-tuxcare.1
|
| TuxCare:npm | react-native-community | @react-native-community/cli-config |
< 12.3.6-tuxcare.1 >= 12.3.6-tuxcare.0, < 12.3.6-tuxcare.1 Fix: upgrade to 12.3.6-tuxcare.1
|
| TuxCare:npm | react-native-community | @react-native-community/cli-debugger-ui |
< 12.3.6-tuxcare.1 >= 12.3.6-tuxcare.0, < 12.3.6-tuxcare.1 Fix: upgrade to 12.3.6-tuxcare.1
|
| TuxCare:npm | react-native-community | @react-native-community/cli-doctor |
< 12.3.6-tuxcare.1 >= 12.3.6-tuxcare.0, < 12.3.6-tuxcare.1 Fix: upgrade to 12.3.6-tuxcare.1
|
| TuxCare:npm | react-native-community | @react-native-community/cli-hermes |
< 12.3.6-tuxcare.1 >= 12.3.6-tuxcare.0, < 12.3.6-tuxcare.1 Fix: upgrade to 12.3.6-tuxcare.1
|
| TuxCare:npm | react-native-community | @react-native-community/cli-platform-android |
< 12.3.6-tuxcare.1 >= 12.3.6-tuxcare.0, < 12.3.6-tuxcare.1 Fix: upgrade to 12.3.6-tuxcare.1
|
| TuxCare:npm | react-native-community | @react-native-community/cli-platform-ios |
< 12.3.6-tuxcare.1 >= 12.3.6-tuxcare.0, < 12.3.6-tuxcare.1 Fix: upgrade to 12.3.6-tuxcare.1
|
| TuxCare:npm | react-native-community | @react-native-community/cli-plugin-metro |
< 12.3.6-tuxcare.1 >= 12.3.6-tuxcare.0, < 12.3.6-tuxcare.1 Fix: upgrade to 12.3.6-tuxcare.1
|
| TuxCare:npm | react-native-community | @react-native-community/cli-server-api |
< 12.3.6-tuxcare.1 >= 12.3.6-tuxcare.0, < 12.3.6-tuxcare.1 Fix: upgrade to 12.3.6-tuxcare.1
|
| TuxCare:npm | react-native-community | @react-native-community/cli-tools |
< 12.3.6-tuxcare.1 Fix: upgrade to 12.3.6-tuxcare.1
|
| TuxCare:npm | react-native-community | @react-native-community/cli-types |
< 12.3.6-tuxcare.1 >= 12.3.6-tuxcare.0, < 12.3.6-tuxcare.1 Fix: upgrade to 12.3.6-tuxcare.1
|
Original advisory text
TuxCare security update for @react-native-community/cli (1 CVE)
TuxCare rebuilt @react-native-community/cli to address 1 CVE. Fixed in 12.3.6-tuxcare.1.
Timeline
Published1 Oct 2026
Updated30 Oct 2026
First seen1 Oct 2026
Sources
CLSA-2026-1790877607 · OSV
Track software like this
Free during beta