fix: prevent RCE in openURLMiddleware via URL sanitization by Copilot · Pull Request #2758 · react-native-community/cli

Copilot · 2026-01-27T20:54:57Z

Addresses CVE-2025-11953: URLs passed to the /open-url endpoint were forwarded directly to open(), enabling command injection on Windows via shell metacharacters.

Changes

Add strict-url-sanitise dependency for security-focused URL validation
Sanitize URLs before passing to open(), rejecting malformed or malicious input with HTTP 400
Add test coverage for known attack vectors

Test cases

'https://www.$(calc.exe).com/foo'// Command substitution in hostname'https://evil.com?|calc.exe'// Windows pipe separator'https://example.com/?a=%¾TA%'// Env var exfiltration (%BETA%)

Original prompt

Reattempt #2735 using the strict-url-sanitise npm package. Parsing errors should be surfaced on the HTTP endpoint and fail.

💡 You can make Copilot smarter by setting up custom instructions, customizing its development environment and configuring Model Context Protocol (MCP) servers. Learn more Copilot coding agent tips in the docs.

…1953) Co-authored-by: huntie <2547783+huntie@users.noreply.github.com>

Co-authored-by: huntie <2547783+huntie@users.noreply.github.com>

… mock Co-authored-by: huntie <2547783+huntie@users.noreply.github.com>

Co-authored-by: huntie <2547783+huntie@users.noreply.github.com>

…ltration Co-authored-by: huntie <2547783+huntie@users.noreply.github.com>

Co-authored-by: huntie <2547783+huntie@users.noreply.github.com>

huntie · 2026-01-27T22:08:14Z

@thymikee Ready for review. This is a heavily steered Copilot diff!

Uses strict-url-sanitise (190k weekly, manually code inspected).
- Rejects URLs with any shell metacharacters.
- Avoids us from maintaining a granular implementation in this codebase.
Local tests covering all cases mentioned in fix: RCE vulnerability from CVE-2025-11953 #2735.

…ive-community#2758) * Initial plan * fix: use strict-url-sanitise to prevent RCE vulnerability (CVE-2025-11953) Co-authored-by: huntie <2547783+huntie@users.noreply.github.com> * refactor: cache sanitizeUrl to improve performance Co-authored-by: huntie <2547783+huntie@users.noreply.github.com> * simplify: use "Invalid URL" error message, remove strict-url-sanitise mock Co-authored-by: huntie <2547783+huntie@users.noreply.github.com> * style: replace it() with test() in openURLMiddleware tests Co-authored-by: huntie <2547783+huntie@users.noreply.github.com> * refactor: use ordinary import for strict-url-sanitise Co-authored-by: huntie <2547783+huntie@users.noreply.github.com> * refactor: remove named export of openURLMiddleware, test default export Co-authored-by: huntie <2547783+huntie@users.noreply.github.com> * test: add CVE-2025-11953 test cases for Windows pipe and command exfiltration Co-authored-by: huntie <2547783+huntie@users.noreply.github.com> * test: add CVE-2025-11953 comment above second test case Co-authored-by: huntie <2547783+huntie@users.noreply.github.com> * fixup tests to not hang when fail --------- Co-authored-by: copilot-swe-agent[bot] <198982749+Copilot@users.noreply.github.com> Co-authored-by: huntie <2547783+huntie@users.noreply.github.com> Co-authored-by: Michał Pierzchała <thymikee@gmail.com>

Initial plan
1e3f67b

CopilotAI assigned Copilot and huntie Jan 27, 2026

Copilotstarted work on behalf of huntie January 27, 2026 20:55 View session

CopilotAIand others added 2 commits January 27, 2026 21:01

fix: use strict-url-sanitise to prevent RCE vulnerability (CVE-2025-1…
353763c
…1953) Co-authored-by: huntie <2547783+huntie@users.noreply.github.com>

refactor: cache sanitizeUrl to improve performance
5f5105b
Co-authored-by: huntie <2547783+huntie@users.noreply.github.com>

CopilotAI changed the title ~~[WIP] Reattempt URL sanitisation using strict-url-sanitise package~~fix: use strict-url-sanitise to prevent RCE in openURLMiddlewareJan 27, 2026

CopilotAI requested a review from huntie January 27, 2026 21:06

Copilotfinished work on behalf of huntie January 27, 2026 21:06

Copilotstarted work on behalf of huntie January 27, 2026 21:08 View session

CopilotAIand others added 2 commits January 27, 2026 21:11

simplify: use "Invalid URL" error message, remove strict-url-sanitise…
f8a1ff0
… mock Co-authored-by: huntie <2547783+huntie@users.noreply.github.com>

style: replace it() with test() in openURLMiddleware tests
08bba3f
Co-authored-by: huntie <2547783+huntie@users.noreply.github.com>

CopilotAI changed the title ~~fix: use strict-url-sanitise to prevent RCE in openURLMiddleware~~fix: prevent RCE via URL sanitization in openURLMiddlewareJan 27, 2026

Copilotfinished work on behalf of huntie January 27, 2026 21:12

Copilotstarted work on behalf of huntie January 27, 2026 21:17 View session

refactor: use ordinary import for strict-url-sanitise
a340aff
Co-authored-by: huntie <2547783+huntie@users.noreply.github.com>

CopilotAI changed the title ~~fix: prevent RCE via URL sanitization in openURLMiddleware~~fix: prevent RCE in openURLMiddleware using strict-url-sanitiseJan 27, 2026

Copilotfinished work on behalf of huntie January 27, 2026 21:20

Copilotstarted work on behalf of huntie January 27, 2026 21:26 View session

refactor: remove named export of openURLMiddleware, test default export
9cdcd7a
Co-authored-by: huntie <2547783+huntie@users.noreply.github.com>

CopilotAI changed the title ~~fix: prevent RCE in openURLMiddleware using strict-url-sanitise~~fix: prevent RCE in openURLMiddleware via URL sanitizationJan 27, 2026

Copilotfinished work on behalf of huntie January 27, 2026 21:31

Copilotstarted work on behalf of huntie January 27, 2026 21:56 View session

test: addCVE-2025-11953test cases for Windows pipe and command exfi…
32fdc76
…ltration Co-authored-by: huntie <2547783+huntie@users.noreply.github.com>

CopilotAI changed the title ~~fix: prevent RCE in openURLMiddleware via URL sanitization~~fix: prevent RCE in openURLMiddleware via strict URL sanitizationJan 27, 2026

Copilotfinished work on behalf of huntie January 27, 2026 21:59

Copilotstarted work on behalf of huntie January 27, 2026 22:00 View session

test: addCVE-2025-11953comment above second test case
d4f2711
Co-authored-by: huntie <2547783+huntie@users.noreply.github.com>

CopilotAI changed the title ~~fix: prevent RCE in openURLMiddleware via strict URL sanitization~~fix: prevent RCE in openURLMiddleware via URL sanitizationJan 27, 2026

Copilotfinished work on behalf of huntie January 27, 2026 22:01

huntie mentioned this pull request Jan 27, 2026
fix: RCE vulnerability from CVE-2025-11953 #2735
Closed

huntie marked this pull request as ready for review January 27, 2026 22:05

huntie requested a review from thymikee as a code owner January 27, 2026 22:05

fixup tests to not hang when fail
41cef8e

thymikee approved these changes Jan 28, 2026
View reviewed changes

thymikee merged commit 45f266c into mainJan 28, 2026
4 of 8 checks passed

thymikee deleted the copilot/reamtempt-url-sanitisation branch January 28, 2026 10:18

This was referenced Jun 23, 2026
URLs unable to open since v20.1.1 #2812
Closed
v20.2.0 #2813
Merged

thymikee mentioned this pull request Jun 25, 2026
fix: restore open-url browser links while respecting CVE-2025-11953 #2814
Merged

This was referenced Jun 29, 2026
Update dependency @react-native-community/cli to v20.2.0 - autoclosed leotm/react-native-template-new-architecture#1980
Closed
Upgrade RNC CLI from 20.1.0 to 20.2.0 (Xcode 27) leotm/react-native-template-new-architecture#2014
Merged

Navigation Menu

Uh oh!

fix: prevent RCE in openURLMiddleware via URL sanitization - #2758

fix: prevent RCE in openURLMiddleware via URL sanitization#2758
thymikee merged 10 commits into
mainfrom
copilot/reamtempt-url-sanitisation

CopilotAI commented Jan 27, 2026•
edited by huntie
Loading

Uh oh!

huntie commented Jan 27, 2026•
edited
Loading

Uh oh!

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

3 participants

Uh oh!

Conversation

CopilotAI commented Jan 27, 2026• edited by huntie Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Changes

Test cases

Uh oh!

huntie commented Jan 27, 2026• edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

3 participants

CopilotAI commented Jan 27, 2026•
edited by huntie
Loading

huntie commented Jan 27, 2026•
edited
Loading