CVE-2025-55182 — React2Shell

CVSS 10.0 CRITICAL | Pre-Auth Remote Code Execution in React Server Components

Discovered by Chinese threat actors. Actively exploited by China-nexus APT groups.

Overview

Dubbed "React2Shell", this vulnerability enables unauthenticated remote code execution via unsafe deserialization in the React Server Components (RSC) "Flight" protocol. Exploitation is trivial and requires no authentication.

Technical Details

The RSC Flight protocol deserializes untrusted data without validation, falling under CWE-502 (Deserialization of Untrusted Data). Attackers craft a malicious serialized payload that, when processed by the server, triggers a module resolution hijack — directing module imports to attacker-controlled code that executes in the server runtime.

Affected Versions

Reproduction Steps

1. Identify a target running a vulnerable React/Next.js version with an exposed RSC endpoint (e.g., /_rsc/, /_flight/, or Next.js Server Action endpoints).
2. Send a crafted HTTP POST request containing the malicious serialized payload to the RSC endpoint.
3. The server deserializes the payload, resolving a module import to attacker-controlled code.
4. Code execution is achieved — spawn a shell, exfiltrate data, or deploy further payloads.

Proof of Concept

python exploit.py --target https://example.com --port 443 --command "id"

Mitigation

Upgrade immediately:

• React: >= 19.0.1, >= 19.1.2, or >= 19.2.1
• Next.js: Apply vendor patch specific to your version

No workarounds exist; patching is the only remediation.

References

• NIST NVD: pending
• CVE Record: https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2025-55182
• React Security Advisory: pending
• OWASP CWE-502: https://cwe.mitre.org/data/definitions/502.html