## https://sploitus.com/exploit?id=9C021D0C-8191-5D1A-BC42-983F0817C1FC
# CVE-2025-55182 โ React2Shell
**CVSS 10.0 CRITICAL | Pre-Auth Remote Code Execution in React Server Components**
Discovered by Chinese threat actors. Actively exploited by China-nexus APT groups.
---
## Overview
Dubbed **"React2Shell"**, this vulnerability enables unauthenticated remote code execution via unsafe deserialization in the React Server Components (RSC) "Flight" protocol. Exploitation is trivial and requires no authentication.
## Technical Details
The RSC Flight protocol deserializes untrusted data without validation, falling under **CWE-502 (Deserialization of Untrusted Data)**. Attackers craft a malicious serialized payload that, when processed by the server, triggers a **module resolution hijack** โ directing module imports to attacker-controlled code that executes in the server runtime.
## Affected Versions
| Product | Affected Versions |
|---|---|
| React | 19.0.0 โ 19.2.0 |
| Next.js | 15.x, 16.x |
## Reproduction Steps
1. Identify a target running a vulnerable React/Next.js version with an exposed RSC endpoint (e.g., `/_rsc/`, `/_flight/`, or Next.js Server Action endpoints).
2. Send a crafted HTTP `POST` request containing the malicious serialized payload to the RSC endpoint.
3. The server deserializes the payload, resolving a module import to attacker-controlled code.
4. Code execution is achieved โ spawn a shell, exfiltrate data, or deploy further payloads.
## Proof of Concept
```bash
python exploit.py --target https://example.com --port 443 --command "id"
```
## Mitigation
Upgrade immediately:
- **React**: `>= 19.0.1`, `>= 19.1.2`, or `>= 19.2.1`
- **Next.js**: Apply vendor patch specific to your version
No workarounds exist; patching is the only remediation.
## References
- NIST NVD: *pending*
- CVE Record: https://vulners.com/cve/CVE-2025-55182
- React Security Advisory: *pending*
- OWASP CWE-502: https://cwe.mitre.org/data/definitions/502.html