CVE-2025-67489 @vitejs/plugin-rsc Remote Code Execution through unsafe dynamic imports in RSC server function APIs on development server

@vitejs/plugin-rs provides React Server Components RSC support for Vite. Versions 0.5.5 and below are vulnerable to arbitrary remote code execution on the development server through unsafe dynamic imports in server function APIs loadServerAction, decodeReply, decodeAction when integrated into RSC...

GHSA-93FV-4PM9-XP28 JDA (Java Discord API) downloads external URLs when updating message components

Impact Anyone using untrusted message components may be affected. On versions =6.0.0,6.1.3 of JDA, the requester will attempt to download external media URLs from components if they are used in an update or send request. If you are used MessagegetComponents or similar to get a list of components...

Server-side Request Forgery (SSRF)

Overview Affected versions of this package are vulnerable to Server-side Request Forgery SSRF in external media URLs passed to sendMessageComponents and other methods that take input originating from MessagegetComponents. An attacker can trigger the application to download arbitrary external...

EUVD-2025-202169

JDA Java Discord API downloads external URLs when updating message components...

JDA (Java Discord API) downloads external URLs when updating message components

Impact Anyone using untrusted message components may be affected. On versions =6.0.0,6.1.3 of JDA, the requester will attempt to download external media URLs from components if they are used in an update or send request. If you are used MessagegetComponents or similar to get a list of components...

Exploit for Deserialization of Untrusted Data in Facebook React

fix-react2shell A CLI tool to detect and fix the critical C...

Exploit for Deserialization of Untrusted Data in Facebook React

React2Shell /$$$$$$$...

Exploit for Deserialization of Untrusted Data in Facebook React

CVE-2025-55182 React2Shell - Proof of Concept ⚠️ SECURIT...

CISA Adds One Known Exploited Vulnerability to Catalog

Updated December 9, 2025: Check for signs of potential compromise on all internet accessible REACT instances after applying mitigations. For more information, see React Blog: Critical Security Vulnerability in React Server Componentslink is external. CISA has added one new vulnerability to its...

Exploit for Deserialization of Untrusted Data in Facebook React

CVE-2025-55182 React Server Components RCE Exploit USAGE: C...

Exploit for Deserialization of Untrusted Data in Facebook React

🛡️ RSC Sentinel Pro Advanced React Server Components R...

Exploit for Deserialization of Untrusted Data in Facebook React

CVE-2025-55182 Advanced Scanner !Pythonhttps://img.shields.i...

Exploit for Deserialization of Untrusted Data in Facebook React

CVE-2025-55182 Advanced Scanner A full-featured exploitation ut...

IBM: [RCE] Remote Code Execution via React Server Components Vulnerability CVE-2025-55182

Vulnerability description not provided...

Exploit for Deserialization of Untrusted Data in Facebook React

CVE-2025-55182 Scanner Simple command-line tool for detecting...

Exploit for Deserialization of Untrusted Data in Facebook React

🔥 RSC RCE Exploit Toolkit !Versionhttps://img.shields.io...

Exploit for Deserialization of Untrusted Data in Facebook React

React2Shell !Languagehttps://img.shields.io/badge/Language...

Exploit for Deserialization of Untrusted Data in Facebook React

CVE-2025-55182 Indicator Scanner This repository provides a...

Exploit for Deserialization of Untrusted Data in Facebook React

react2shell-scanner-rust Detect CVE-2025-55182 & CVE-2025-664...

React 19 Server Components Critical Vulnerability (CVE-2025-55182, CVE-2025-55183, CVE-2025-55184)

On December 3, 2025, the React team disclosed a critical remote code execution vulnerability CVE-2025-55182, CVSS 10.0 affecting React 19 Server Components. This vulnerability has raised concerns among Vaadin users and security scanning tools. Update: On December 11 and 12, 2025, two new...