Multiple Threat Actors Leveraging CVE-2025-55182 (React2Shell)

By The Hivemind

Read the original on blog.polyswarm.io (new tab)

Excerpt

Executive Summary

Multiple vendors have observed active exploitation of CVE-2025-55182, a critical remote code execution vulnerability in React Server Components and frameworks like Next.js. Multiple threat actors, including China-nexus and North Korea-nexus APTs and criminal threat actors have been observed leveraging CVE-2025-55182. Key Takeaways

Multiple threat actors have been observed exploiting CVE-2025-55182,…

The opening of the report, shown for reference. The full report, with its figures and indicators, is published by polyswarm.io on blog.polyswarm.io.