The U.S. Cybersecurity and Infrastructure Safety Company (CISA) on Friday formally added a important safety flaw impacting React Server Elements (RSC) to its Identified Exploited Vulnerabilities (KEV) catalog following stories of energetic exploitation within the wild.
The vulnerability, CVE-2025-55182 (CVSS rating: 10.0), pertains to a case of distant code execution that may very well be triggered by an unauthenticated attacker with out requiring any particular setup. It is also tracked as React2Shell.
“Meta React Server Elements accommodates a distant code execution vulnerability that might enable unauthenticated distant code execution by exploiting a flaw in how React decodes payloads despatched to React Server Perform endpoints,” CISA stated in an advisory.
The issue stems from insecure deserialization within the library’s Flight protocol, which React makes use of to speak between a server and consumer. In consequence, it results in a situation the place an unauthenticated, distant attacker can execute arbitrary instructions on the server by sending specifically crafted HTTP requests.
“The method of changing textual content into objects is extensively thought of one of the harmful courses of software program vulnerabilities,” Martin Zugec, technical options director at Bitdefender, stated. “The React2Shell vulnerability resides within the react-server bundle, particularly in the way it parses object references throughout deserialization.”
The vulnerability has been addressed variations 19.0.1, 19.1.2, and 19.2.1 of the next libraries –
- react-server-dom-webpack
- react-server-dom-parcel
- react-server-dom-turbopack
A number of the downstream frameworks that rely on React are additionally impacted. This contains: Subsequent.js, React Router, Waku, Parcel, Vite, and RedwoodSDK.
The event comes after Amazon reported that it noticed assault makes an attempt originating from infrastructure related to Chinese language hacking teams like Earth Lamia and Jackpot Panda inside hours of public disclosure of the flaw. Coalition, Fastly, GreyNoise, VulnCheck, and Wiz have additionally reported seeing exploitation efforts focusing on the flaw, indicating that a number of menace actors are participating in opportunistic assaults.
 |
| Picture Supply: GreyNoise |
A number of the assaults have concerned the deployment of cryptocurrency miners, in addition to the execution of “low cost math” PowerShell instructions to determine profitable exploitation, adopted by working instructions to drop in-memory downloaders able to retrieving an extra payload from a distant server.
In line with information shared by assault floor administration platform Censys, there are about 2.15 million situations of internet-facing companies which may be affected by this vulnerability. This contains uncovered internet companies utilizing React Server Elements and uncovered situations of frameworks resembling Subsequent.js, Waku, React Router, and RedwoodSDK.
In an announcement shared with The Hacker Information, Palo Alto Networks Unit 42 stated it has confirmed over 30 affected organizations throughout quite a few sectors, with one set of exercise in line with a Chinese language hacking crew tracked as UNC5174 (aka CL-STA-1015). The assaults are characterised by the deployment of SNOWLIGHT and VShell.
“Now we have noticed scanning for susceptible RCE, reconnaissance exercise, tried theft of AWS configuration and credential information, in addition to set up of downloaders to retrieve payloads from attacker command and management infrastructure,” Justin Moore, senior supervisor of menace intel analysis at Palo Alto Networks Unit 42, stated.
Safety researcher Lachlan Davidson, who’s credited with discovering and reporting the flaw, has since launched a number of proof-of-concept (PoC) exploits, making it crucial that customers replace their situations to the newest model as quickly as doable. One other working PoC has been revealed by a Taiwanese researcher who goes by the GitHub deal with maple3142.
Pursuant to Binding Operational Directive (BOD) 22-01, Federal Civilian Government Department (FCEB) companies have till December 26, 2025, to use the mandatory updates to safe their networks.
