₦airaland Forum

A recent vulnerability in React Server Components , nicknamed “React2Shell”, that allows unauthenticated remote code execution (RCE) on servers. This means an attacker can send a malicious request and run arbitrary code on the server without any user authentication or developer missteps.

Microsoft says attackers have already compromised "several hundred machines across a diverse set of organizations" via the React2Shell flaw, using the access to execute code, deploy malware, and, in some cases, deliver ransomware. Source: https://www.theregister.com/2025/12/18/react2shell_exploitation_spreads_as_microsoft

China-nexus cyber threat groups rapidly exploit React2Shell vulnerability (CVE-2025-55182)

December 12, 2025: The blog post was updated to clarify when customers need to update their ReactJS version.

Within hours of the public disclosure of CVE-2025-55182 (React2Shell) on December 3, 2025, Amazon threat intelligence teams observed active exploitation attempts by multiple China state-nexus threat groups, including Earth Lamia and Jackpot Panda. This critical vulnerability in React Server Components has a maximum Common Vulnerability Scoring System (CVSS) score of 10.0 and affects React versions 19.x and Next.js versions 15.x and 16.x when using App Router. While this vulnerability doesn’t affect AWS services, we are sharing this threat intelligence to help customers running React or Next.js applications in their own environments take immediate action.
Source: https://aws.amazon.com/blogs/security/china-nexus-cyber-threat-groups-rapidly-exploit-react2shell-vulnerability-cve-2025-55182