AWS: China-linked threat actors weaponized React2Shell hours after disclosure

Multiple China-linked threat actors began exploiting the CVE-2025-55182, also known as the React2Shell flaw, within hours, according to AWS Security. The vulnerability is a pre-authentication remote code execution flaw in React Server Components versions 19.0.0, 19.1.0, 19.1.1, and 19.2.0, affecting packages including react-server-dom-parcel, react-server-dom-turbopack, and react-server-dom-webpack, with unsafe payloads deserialised from HTTP requests to Server Function endpoints.

AWS Security observed exploitation attempts in AWS MadPot infrastructure coming from IPs and networks historically linked to Earth Lamia and Jackpot Panda, groups described as China-nexus threat actors; Earth Lamia targets LATAM, the Middle East and Southeast Asia, while Jackpot Panda focuses on East and Southeast Asia for intelligence tied to security and corruption. The report notes that large anonymisation networks are used by multiple threat groups to mask attacker identity, complicating attribution.

The researchers highlighted that these actors are moving quickly, weaponising public PoCs and executing broad multi-CVE campaigns, and one unattributed cluster spent nearly an hour on 4 December 2025 (UTC) troubleshooting exploitation attempts in MadPot. according to AWS Security.