CVEReports
CVEReports

Automated vulnerability intelligence platform. Comprehensive reports for high-severity CVEs generated by AI.

Product

  • Home
  • Sitemap
  • RSS Feed

Company

  • About
  • Contact
  • Privacy Policy
  • Terms of Service

© 2026 CVEReports. All rights reserved.

Made with love by Amit Schendel & Alon Barad

CVE-2025-55182

React2Shell: When Server Components Serve Shells

Alon Barad
Alon Barad
Software Engineer

Jan 2, 2026·6 min read·85 visits

Executive Summary (TL;DR)

CVSS 10.0 RCE in Next.js and React Server Components. Attackers can leverage the `constructor` property in the React Flight protocol to execute arbitrary code. Active in-the-wild exploitation confirmed.

A catastrophic Remote Code Execution (RCE) vulnerability in React Server Components (RSC) allows unauthenticated attackers to execute arbitrary JavaScript on the server via the React Flight protocol. Dubbed 'React2Shell', this issue stems from insecure deserialization and a build process failure.

Official Patches

ReactOfficial React Advisory
Next.jsNext.js Security Update

Fix Analysis (1)

Technical Appendix

CVSS Score
10.0/ 10
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H
EPSS Probability
47.37%
Top 4% most exploited
50,000
via Shodan

Affected Systems

Next.js (Versions 13.3.0 - 15.0.x)React Server Components (RSC) RuntimesWaku FrameworkParcel RSCVite RSC Plugin

Affected Versions Detail

Product
Affected Versions
Fixed Version
Next.js
Vercel
>= 13.3.0, < 14.2.3514.2.35
Next.js
Vercel
15.0.0 - 15.0.615.0.7
react-server-dom-webpack
Meta
19.0.019.0.1
AttributeDetail
CWE IDCWE-502 (Deserialization of Untrusted Data)
CVSS Score10.0 (Critical)
Attack VectorNetwork (Pre-Auth)
EPSS Score47.37% (High)
KEV StatusListed (Active Exploitation)
PlatformNode.js / React

MITRE ATT&CK Mapping

T1190Exploit Public-Facing Application
Initial Access
T1059.007Command and Scripting Interpreter: JavaScript
Execution
T1203Exploitation for Client Execution
Execution
CWE-502
Deserialization of Untrusted Data

The application deserializes untrusted data without sufficiently verifying that the resulting data will be valid, allowing the execution of arbitrary code.

Known Exploits & Detection

GitHubProof of concept for React2Shell exploitation
AssetnoteScanner to identify vulnerable React Server Component endpoints
NucleiDetection Template Available

Vulnerability Timeline

Vendor releases security advisories and patches
2025-12-03
Exploit PoCs begin appearing on GitHub
2025-12-04
Added to CISA Known Exploited Vulnerabilities (KEV) Catalog
2025-12-05
Active exploitation by China-nexus groups reported
2025-12-06

References & Sources

  • [1]AWS Security Blog: China-Nexus Exploitation
  • [2]CISA KEV Entry
Related Vulnerabilities
CVE-2025-66478

Attack Flow Diagram

Press enter or space to select a node. You can then use the arrow keys to move the node around. Press delete to remove it and escape to cancel.
Press enter or space to select an edge. You can then press delete to remove it or escape to cancel.

More Reports

•about 1 hour ago•CVE-2026-55153
7.1

CVE-2026-55153: JNDI Injection and Deserialization Gadget Abuse in mchange-commons-java

A JNDI Injection and Deserialization Gadget vulnerability exists in mchange-commons-java prior to version 0.6.0. The com.mchange.v2.naming.JavaBeanObjectFactory component permits arbitrary class instantiation and setter invocation, allowing attackers to perform Server-Side Request Forgery (SSRF) and remote class loading.

Alon Barad
Alon Barad
1 views•5 min read
•about 2 hours ago•GHSA-8RW6-P7M8-63JP
6.5

GHSA-8RW6-P7M8-63JP: Array Element-Level SELECT Permissions Leak in SurrealDB

SurrealDB versions supporting element-level SELECT permissions on arrays are vulnerable to a logical authorization bypass. Due to an index-shifting error during array filtration, restricted elements can skip permission checks and leak to unauthorized record users.

Alon Barad
Alon Barad
4 views•6 min read
•1 day ago•CVE-2026-12243
7.5

CVE-2026-12243: Incomplete Path Traversal Validation and Percent-Encoding Bypass in NLTK

CVE-2026-12243 is a path traversal vulnerability in the Natural Language Toolkit (NLTK) version 3.9.4. The flaw exists because the input validation routine fails to account for percent-encoded directory traversal sequences like '..%2f' before passing them to urllib.request.url2pathname(), which decodes them into active traversal sequences.

Amit Schendel
Amit Schendel
5 views•8 min read
•1 day ago•CVE-2026-73654
8.5

CVE-2026-73654: Prototype Pollution in Trigger.dev leading to Cascading Denial of Service

CVE-2026-73654 is a high-severity prototype pollution vulnerability in Trigger.dev. The flaw occurs during the handling of run-metadata updates through the PUT /api/v1/runs/:runId/metadata endpoint. Because user-supplied keys are parsed directly by the @jsonhero/path library without sanitization, an authenticated attacker with low privileges can pollute the global Object.prototype. This causes database queries via Prisma ORM to fail validation and induces unhandled exceptions in the Prometheus metrics client, resulting in a process-wide denial of service.

Alon Barad
Alon Barad
11 views•6 min read
•1 day ago•CVE-2026-73559
6.5

CVE-2026-73559: Uncontrolled Resource Consumption in vLLM API completions

CVE-2026-73559 is an uncontrolled resource consumption vulnerability in the vLLM engine, specifically within the /v1/completions API endpoint, allowing authenticated attackers to cause application-level denial of service via unbounded prompt arrays.

Amit Schendel
Amit Schendel
10 views•5 min read
•1 day ago•CVE-2026-54526
9.9

CVE-2026-54526: Strict Template Referencing Bypass and Privilege Escalation in Argo Workflows

A critical security bypass vulnerability in Argo Workflows allows authenticated attackers with workflow submission privileges to bypass 'Strict' or 'Secure' template referencing restrictions. By injecting unvalidated fields into the nested ArtifactGC configuration, attackers can execute arbitrary pod patches, leading to host namespace escape and cluster-wide privilege escalation.

Alon Barad
Alon Barad
15 views•6 min read