React2Shell: Anatomy of a max-severity flaw that sent shockwaves through the web

"The React 19 library for building application interfaces was hit with a remote code vulnerability, React2Shell, about a month ago. However, as researchers delve deeper into the bug, the larger picture gradually unravels. The vulnerability enables unauthenticated remote code execution through React Server Components, allowing attackers to execute arbitrary code on affected servers via a crafted request. In other words, a foundational web framework feature quietly became an initial access vector."

"Within hours of disclosure, multiple security firms confirmed active exploitation in the wild. Google's Threat Intelligence Group ( GTIG) and AWS both reported real-world abuse, collapsing the already-thin gap between vulnerability awareness and compromise. "React2Shell is another reminder of how fast exploitation timelines have become," said Nathaniel Jones, field CISO at Darktrace. "The CVE drops, a proof-of-concept is circulating, and within hours you're already seeing real exploitation attempts.""

React2Shell is an unauthenticated remote code execution vulnerability in React 19 Server Components that enables attackers to execute arbitrary code on affected servers via crafted requests. Multiple security firms and cloud providers confirmed active exploitation within hours of disclosure, including reports from Google's Threat Intelligence Group and AWS. The vulnerability impacts default React and Next.js deployments, making many enterprise environments exposed by default. Early analyses by Wiz and Unit 42 demonstrated input traversal into dangerous execution paths and reliable exploitability across environments, showing minimal variation required for successful attacks. Rapid exploitation compressed the window between discovery and compromise.

Read at InfoWorld