React2Shell Vulnerability Under Attack from China-Nexus Groups

React2Shell is a critical vulnerability in the React library that is under attack by China-nexus actors, with CVE-2025-55182 described as an unauthenticated remote code execution affecting React Server Components versions 19.0.0, 19.1.0, 19.1.1, and 19.2.0 across three packages. The flaw, caused by unsafe deserialization, has a CVSS score of 10, and patches are available for React 19.0.1, 19.1.2 and 19.2.1, with mitigations for downstream impacts also generally available.

According to Amazon, CJ Moses warned that within hours of the disclosure on 3 December 2025, multiple China state-nexus groups, including Earth Lamia and Jackpot Panda, were observed exploiting the vulnerability, using automated scanning tools and PoCs to target organisations. The article notes that threat actors are monitoring for new disclosures and rapidly integrating public exploits into their scanning infrastructure to conduct broad campaigns across several CVEs simultaneously. Cloudflare also faced a brief outage tied to its mitigation efforts for React2Shell, illustrating the broad impact of the threat.