RCE in React Server Components, impacting React and Next.js. I usually don’t say this, but patch right freakin’ now. The React CVE listing (CVE-2025-55182) is a perfect 10.
Further research:
This one looks real but I can’t get it to fire, even after fixing their install commands. Server runs but creates a null, not a function.
This breakdown tracks with what I have gleaned from the patch myself.
Confirmed working PoC: CVE-2025-55182.http · GitHub
Here’s what GreyNoise is seeing: CVE-2025-55182 (React2Shell) Opportunistic Exploitation In The Wild: What The GreyNoise Observation Grid Is Seeing So Far
Aaand a PoC from the vuln discoverer. GitHub - lachlan2k/React2Shell-CVE-2025-55182-original-poc: Original Proof-of-Concept's for React2Shell CVE-2025-55182
Variants from VulnCheck: Reacting to Shells: React2Shell Variants & the CVE-2025-55182 Exploit Ecosystem | Blog | VulnCheck