A critical vulnerability dubbed “React2Shell”, being tracked as CVE-2025-55182 with a CVSS score of 10.0, was recently discovered in React’s Server Components (RSC) that could allow for pre-authentication remote code execution. If exploited, this vulnerability could enable unauthenticated threat actors to execute arbitrary code on servers running vulnerable React 19 RSC logic. React is a javascript library used to build the user interface of many of the websites people use every day. Because it is so widely used, it has quietly become part of the digital foundation that modern websites rely on. Threat actors can leverage this vulnerability to exfiltrate secrets, pivot deeper into the environment, create persistence mechanisms (webshells), or deploy secondary payloads. A compromised RSC endpoint becomes the Initial Intrusion Vector (IIV) for threat actors, and could allow for lateral movement and complete environment compromise.
Security researchers emphasize that exploiting this bug is trivial. In testing, it worked with near 100% reliability and requires only a crafted HTTP request, which involves no user interaction. The attack can be performed by remote threat actors over the internet, making it an attractive initial compromise vector. The issue stems from unsafe deserialization within the RSC “Flight” protocol, allowing a threat actor to hijack module resolution and invoke privileged functions on the backend. The flaw affects React 19.0.0 through 19.2.0 and any frameworks that bundle RSC, including Next.js 15 and 16. Exploitation is trivial, reliable, and requires only a crafted HTTP request. Frameworks incorporating these packages inherit the flaw.
The vulnerability arises from React’s server-side handling of RSC action metadata. Pre-patch, the server incorrectly trusts user-supplied identifiers and fails to verify that requested functions are valid exported server actions. By abusing this logic, a threat actor can instruct the server to load internal Node.js modules and execute functions like child_process.execSync. Proof-of-concept exploits already available on GitHub and other research related sites as of December 3, 2025 demonstrate direct execution of OS commands through manipulated multipart form submissions that mimic legitimate RSC calls. Once executed, threat actor-supplied commands run with the privileges of the server process.
A working proof-of-concept exploit for CVE-2025-55182 is now public, after security researcher maple3142 released an HTTP-based payload that achieves unauthenticated remote code execution against React Server Components in at least Next.js 16.0.6, confirming that the issue is practically exploitable and not just theoretical. Research into the exploitation of this vulnerability is attributing early activity to multiple China state-nexus threat actors, including EARTH LAMIA and JACKPOT PANDA, who started probing and exploiting React2Shell within hours of the December 3 public disclosure, despite AWS-managed services themselves not being directly impacted.
If your unpatched server was exposed to the public internet prior to December 3, 2025, investigate for signs of compromise. Although mass exploitation typically follows the release of PoC code, sophisticated threat actors can develop private exploits immediately.
Our team is standing by to answer any questions relating to this vulnerability. Reach us 24x7 at response@cybereason.com.
Devon Ackerman, Global Head of DFIR, Cybereason
Devon Ackerman is the Global Head of DFIR at Cybereason. Devon leverages over 15 years of experience in the cybersecurity industry, with a focus on Digital Forensics and Incident Response. He has built, managed, and led large global incident response teams, and has worked hundreds of incident response engagements, including some of the most complex in the world.
In May 1990, a massive operation carried out by hundreds of Secret Service and FBI agents was focused on a new type of crime: Hacking. But every action has an equal and opposite reaction, and the reaction to Operation Sundevil was the birth of a new power in the cybersphere: the Electronic Frontier Foundation - check it out…
A critical, unauthenticated remote code execution vulnerability, tracked as CVE-2025-32433, have been discovered in Erlang/OTP's SSH implementation.
