Exploitation Activity Ramps Up Against React2Shell

Exploitation activity against React2Shell has ramped up since the public disclosure of CVE-2025-55182, with attackers increasingly targeting Next.js and containerised workloads in cloud environments.

The vulnerability, a critical remote code execution flaw in the React open source software, was first disclosed on 3 December, and React2Shell has a maximum CVSS score of 10, with activity described as having begun within hours of disclosure by China-nexus groups, according to Amazon chief information security officer CJ Moses.

Wiz researchers noted in a Monday blog post that in-the-wild attacks ranged from cryptomining and credential theft to backdoor campaigns, while VulnCheck said exploitation was already widespread and had observed hundreds of exploit attempts as of 6 December. Censys, in an advisory on 5 December, reported more than 2.1 million exposed Web services running Next.js or other RSC-based software frameworks, urging organisations to treat any internet-facing server running impacted RSC code as vulnerable until updated.

The overall picture is one of rapid opportunistic exploitation, with researchers highlighting that most attacks target internet-facing Next.js apps and other Kubernetes/containerised workloads, and warnings that other frameworks using the RCS protocol could also be affected.