React2Shell: In-the-Wild Exploitation Expected for Critical React Vulnerability

SecurityWeek reports that a critical React vulnerability, CVE-2025-55182, can allow a remote, unauthenticated attacker to achieve remote code execution, with patches issued for versions 19.0, 19.1.0, 19.1.1 and 19.2.0, to be followed by 19.0.1, 19.1.2 and 19.2.1.

The flaw, dubbed React2Shell by the cybersecurity community, was reported to React developers on 29 November by Lachlan Davidson, and is linked to how React decodes payloads sent to React Server Function endpoints; some fear it could be exploitable even if RSC is not used, provided React Server Components are supported. At the time of writing there were no confirmed in-the-wild exploits, though a PoC exploit emerged within 24 hours and the vulnerability has been added to scanners.

According to Wiz, 39% of cloud environments contain vulnerable React instances, while researchers note that Next.js is also affected and Google Cloud, AWS and Cloudflare have all rolled out protections or rules to block exploitation attempts."}