Critical React2Shell Flaw Added to CISA KEV After Confirmed Active Exploitation

The U.S. Cybersecurity and Infrastructure Security Agency (CISA) on Friday formally added the critical React Server Components flaw, CVE-2025-55182 (also tracked as React2Shell), to its Known Exploited Vulnerabilities catalog after reports of active exploitation in the wild.

According to CISA, the vulnerability could allow unauthenticated remote code execution by exploiting insecure deserialization in the library’s Flight protocol, enabling an attacker to trigger code on a server via specially crafted HTTP requests. CISA notes a CVSS score of 10.0 and the flaw affects React Server Components across libraries such as react-server-dom-webpack, react-server-dom-parcel, and react-server-dom-turbopack, with downstream frameworks including Next.js and Vite also impacted.

Palo Alto Networks Unit 42 has confirmed over 30 affected organisations, with activity consistent with a China-linked group tracked as UNC5174, deploying tools like SNOWLIGHT and VShell. Data shared by Censys suggests about 2.15 million internet-facing services may be affected, and the campaign has included cryptocurrency miners and cheap math PowerShell commands to establish exploitation before dropping in‑memory downloaders. Federal agencies have until 26 December 2025 to apply the necessary updates under Binding Operational Directive 22-01.