“React2Shell” Storm: China-Nexus Groups Weaponize Critical React Flaw Hours After Disclosure

According to Amazon threat intelligence teams, the publicly disclosed critical React vulnerability in the React ecosystem has already spawned active exploitation campaigns by state-sponsored groups. The report notes that multiple China-nexus groups, specifically Earth Lamia and Jackpot Panda, began operationalising the flaw, React2Shell (CVE-2025-55182), on 3 December 2025.

The flaw, rated 10.0 on the CVSS, enables unauthenticated remote code execution in applications using React Server Components, affecting React 19.x and Next.js 15.x and 16.x with the App Router. In a telltale example captured by MadPot on 4 December 2025, an unattributed cluster spent nearly an hour troubleshooting an exploit, sending 116 requests between 2:30 AM and 3:22 AM UTC and attempting commands such as whoami and id, writing to /tmp/pwned.txt, and reading /etc/passwd.

Defenders are urged to search logs for indicators such as HTTP headers containing next-action or rsc-action-id, and payload patterns like $@ or "status":"resolved_model".