It didn’t take long: CVE-2025-55182 is now under active exploitation

On 4 December 2025, researchers published details on the critical vulnerability CVE-2025-55182, which received a CVSS score of 10.0 and is unofficially dubbed React4Shell for its impact on React Server Components. Almost immediately after the exploit was published, Kaspersky honeypots began registering attempts to leverage CVE-2025-55182, with the number of attacks increasing by 8 December 2025.

The flaw lies in unsafe deserialization within the Server Actions component of React Server Components, allowing an attacker to execute commands and read or write files on the server with the application’s privileges. In encounters observed by Securelist, attackers often first verify they are not attacking a honeypot, then attempt to download malicious files using wget or curl, and some deployments include PowerShell-based payloads that install XMRig.

The report notes that CVE-2025-55182 has been weaponised by multiple campaigns, including Mirai/Gafgyt variants, crypto miners and the RondoDox botnet, with potential implications for cloud infrastructure and software supply chains.