Chinese Hackers Exploiting React2Shell Vulnerability

According to AWS, exploitation attempts of the React2Shell vulnerability, CVE-2025-55182, were observed by China-linked threat actors within hours of public disclosure, after the flaw was reported to React maintainer Meta on 29 November and patched on 3 December.

The vulnerability, which enables unauthenticated remote code execution via specially crafted HTTP requests, affects React’s open source library used to create user interfaces and powers millions of websites, with the affected NPM package reportedly seeing millions of weekly downloads. AWS noted that attribution is challenging because threat actors frequently share attack infrastructure, but it believes the attempts have been conducted by Earth Lamia and Jackpot Panda.

Earth Lamia has been active since at least 2023 and has targeted a wide range of industries across Latin America, the Middle East and Southeast Asia, while Jackpot Panda has operated since 2020 in Asia. Wiz has stated that 39% of cloud environments contain vulnerable React instances, highlighting the broader risk to cloud deployments. Some PoCs are fake, but AWS said there are public PoCs that do work, and that threat actors are actively debugging and refining their exploitation techniques against live targets.