fix: Add stricter URL validation to openURLMiddleware

[huntie]

Summary

References

• OS command injection on windows when opening urls sindresorhus/open#323
• https://learn.microsoft.com/en-us/windows-server/administration/windows-commands/start

Test Plan

Invalid URL

✅ Blocked

Sanity check — regular URL

✅ OK
✅ Opens web browser

Checklist

• Documentation is up to date.
• Follows commit message convention described in CONTRIBUTING.md.
• For functional changes, my test plan has linked these CLI changes into a local react-native checkout (instructions).

[thymikee]

Thanks! Feel free to merge

[huntie]

d003eab: Remove {appName: 'browser'} argument — led to a no-op in local testing on a macOS system.

[benomatis]

@huntie @szymonrybczak can we have a fix for this in v15 as well please? I would appreciate that a lot!

[szymonrybczak]

@benomatis 15.x wasn't affected by this security vulnerability, since it has already URL validation

[benomatis]

@szymonrybczak the CVE communication I read about this (maybe I use wrong sources) says this:

The vulnerability directly affects the @react-native-community/cli-server-api package, versions 4.8.0 to 20.0.0-alpha.2

so is this an incorrect statement? what would be a reliable source of information on the CVE?

My source: https://jfrog.com/blog/cve-2025-11953-critical-react-native-community-cli-vulnerability/

This originally reached me via a GitHub dependabot alert: GHSA-399j-vxmf-hjvr

[szymonrybczak]

Take a look at my response:

https://x.com/szymonrybczak/status/1986199665000566848?s=46

the "official" is a bit wrong

[tommasini]

@szymonrybczak This issue was created, I think many people will cross it
#2733

Can you go there and explain your thoughts! It would be awesome understanding why this was flagged now and is wrong

[szymonrybczak]

@tommasini good point, thank you for suggesting it! I'll report our findings there too 👍

[benomatis]

@szymonrybczak how can this reach GitHub so that dependabot doesn't report it and create panic?