Exploit for Deserialization of Untrusted Data in Facebook React

React2Shell Exploit - CVE-2025-55182 Author: andrei2308...

Exploit for Deserialization of Untrusted Data in Facebook React

React2Shell CVE-2025-55182 Visualization An interactive edu...

Exploit for Deserialization of Untrusted Data in Facebook React

CVE-2025-55182 React2Shell Exploit Overview CVE-2025-55...

CVE-2025-55183 and CVE-2025-55184: Mitigating React/Next.js Vulnerabilities

...

React2Shell: Decoding CVE-2025-55182 – The Silent Threat in React Server Components

On December 3, 2025, a critical remote code execution RCE vulnerability, dubbed "React2Shell," was disclosed, impacting React Server Components and frameworks like Next.js. The flaw, CVE-2025-55182, could lead to full server takeover and is rated CVSS 10.0. It is under active exploitation, has be...

It didn’t take long: CVE-2025-55182 is now under active exploitation

On December 4, 2025, researchers published details on the critical vulnerability CVE-2025-55182, which received a CVSS score of 10.0. It has been unofficially dubbed React2Shell, as it affects React Server Components RSC functionality used in web applications built with the React library. RSC...

Exploit for Deserialization of Untrusted Data in Facebook React

CV...

Exploit for Deserialization of Untrusted Data in Facebook React

CVE-2025-55182 Exploitation Tool A comprehensive security res...

Exploit for CVE-2025-66478

Next.js-RSC-RCE-Scanner-CVE-2025-66478 CVE-2025-66478 Next.js...

React Server Components deserialization vulnerability

Added: 12/11/2025 Background React is a Javascript library for building user interfaces. React Server Components are React components designed for running on web servers. Problem A deserialization vulnerability in React Server Components allows a remote attacker to execute arbitrary commands by...

CVE-2025-55184: Deserialization of Untrusted Data

A pre-authentication denial of service vulnerability exists in React Server Components versions 19.0.0, 19.0.1 19.1.0, 19.1.1, 19.1.2, 19.2.0 and 19.2.1, including the following packages: react-server-dom-parcel, react-server-dom-turbopack, and react-server-dom-webpack. The vulnerable code unsafe...

CVE-2025-55183: Undefined Security Weakness

An information leak vulnerability exists in specific configurations of React Server Components versions 19.0.0, 19.0.1 19.1.0, 19.1.1, 19.1.2, 19.2.0 and 19.2.1, including the following packages: react-server-dom-parcel, react-server-dom-turbopack, and react-server-dom-webpack. A specifically...

Meta React Server Components 安全漏洞

Meta React Server Components is a series of components from Meta USA. A security vulnerability exists in Meta React Server Components versions 19.0.0, 19.0.1, 19.1.0, 19.1.1, 19.1.2, 19.2.0, and 19.2.1, which stems from insecure deserialization of HTTP request loads and could lead to an infinite...

PT-2025-50722

Name of the Vulnerable Software and Affected Versions React versions 19.0.0 through 19.2.1 react-server-dom-parcel versions 19.0.0 through 19.2.1 react-server-dom-turbopack versions 19.0.0 through 19.2.1 react-server-dom-webpack versions 19.0.0 through 19.2.1 Description An information leak issue...

React Server Components deserialization vulnerability

Added: 12/11/2025 Background React is a Javascript library for building user interfaces. React Server Components are React components designed for running on web servers. Problem A deserialization vulnerability in React Server Components allows a remote attacker to execute arbitrary commands by...

Exploit for Deserialization of Untrusted Data in Facebook React

R2SAE - React2Shell Auto-Exploit A Firefox extension...

CVE-2025-67489

@vitejs/plugin-rs provides React Server Components RSC support for Vite. Versions 0.5.5 and below are vulnerable to arbitrary remote code execution on the development server through unsafe dynamic imports in server function APIs loadServerAction, decodeReply, decodeAction when integrated into RSC...

Exploit for Deserialization of Untrusted Data in Facebook React

CVE-2025-55182 React2Shell Reproduction Environment ⚠️...

Exploit for Deserialization of Untrusted Data in Facebook React

CVE-2025-55182 A simp...

React2Shell Exploitation Delivers Crypto Miners and New Malware Across Multiple Sectors

React2Shell continues to witness heavy exploitation, with threat actors leveraging the maximum-severity security flaw in React Server Components RSC to deliver cryptocurrency miners and an array of previously undocumented malware families, according to new findings from Huntress. This includes a...