Critical React2Shell Flaw Added to CISA KEV After Confirmed Active Exploitation

"The U.S. Cybersecurity and Infrastructure Security Agency (CISA) on Friday formally added a critical security flaw impacting React Server Components (RSC) to its Known Exploited Vulnerabilities ( KEV) catalog following reports of active exploitation in the wild. The vulnerability, CVE-2025-55182 (CVSS score: 10.0), relates to a case of remote code execution that could be triggered by an unauthenticated attacker without requiring any special setup. It's also tracked as React2Shell."

""Meta React Server Components contains a remote code execution vulnerability that could allow unauthenticated remote code execution by exploiting a flaw in how React decodes payloads sent to React Server Function endpoints," CISA said in an advisory. The problem stems from insecure deserialization in the library's Flight protocol, which React uses to communicate between a server and client. As a result, it leads to a scenario where an unauthenticated, remote attacker can execute arbitrary commands on the server by sending specially crafted HTTP requests."

""The process of converting text into objects is widely considered one of the most dangerous classes of software vulnerabilities," Martin Zugec, technical solutions director at Bitdefender, said. "The React2Shell vulnerability resides in the react-server package, specifically in how it parses object references during deserialization." The vulnerability has been addressed versions 19.0.1, 19.1.2, and 19.2.1 of the following libraries -"

An insecure deserialization flaw in React Server Components' Flight protocol (CVE-2025-55182, CVSS 10.0) enables unauthenticated remote code execution by sending specially crafted HTTP requests to React Server Function endpoints. The vulnerability is tracked as React2Shell and allows attackers to execute arbitrary commands on affected servers without special setup. Patches are available in react-server-dom-webpack, react-server-dom-parcel, and react-server-dom-turbopack versions 19.0.1, 19.1.2, and 19.2.1. Downstream frameworks including Next.js, React Router, Waku, Parcel, Vite, and RedwoodSDK are also impacted. Attack attempts were observed originating from infrastructure tied to Chinese threat groups shortly after public disclosure.

Read at The Hacker News