React.js shell shocked by 10.0 critical vulnerability…

Quick Overview

A critical, unauthenticated Remote Code Execution (RCE) vulnerability, CVE-2025-55182 (dubbed "React2Shell"), was discovered in React Server Components versions 19.0.0, 19.1.0, 19.1.1, and 19.2.0, allowing attackers to exploit unsafe deserialization in the Flight protocol to execute arbitrary code on the server without prior authentication or a valid session.

Key Points: The vulnerability, CVE-2025-55182 ("React2Shell"), scored a critical 10.0 CVSS base score. The flaw exists due to unsafe deserialization of payloads from HTTP requests to Server Function endpoints within the React Flight protocol. Affected packages include react-server-dom-webpack, react-server-dom-parcel, and react-server-dom-turbopack, impacting React Server Components versions 19.0.0 through 19.2.0. Exploitation allows an attacker to achieve RCE without authentication or a valid session by crafting a malicious Flight payload. Censys observed over 2.15 million internet-facing services potentially affected, including those using Next.js, Waku, and RedwoodSDK. China-nexus threat groups, like Earth Lamia and Jackpot Panda, were observed actively exploiting this vulnerability shortly after its public disclosure on December 3, 2025. The immediate recommendation from The React Team is to upgrade affected packages immediately.

Context: The video discusses the discovery and immediate exploitation of a severe security vulnerability in the React ecosystem, specifically affecting React Server Components (RSC) and frameworks like Next.js that utilize the Flight protocol for server-to-client communication. This flaw, labeled CVE-2025-55182, is presented as a catastrophic event in the JavaScript world, drawing parallels to the notorious Log4Shell vulnerability from 2021 due to its high severity and broad impact across modern web applications.

Detailed Analysis

The video details the critical vulnerability CVE-2025-55182, nicknamed "React2Shell," which affects React Server Components versions 19.0.0, 19.1.0, 19.1.1, and 19.2.0, including related packages like react-server-dom-webpack. This vulnerability is an unauthenticated Remote Code Execution (RCE) flaw stemming from the unsafe deserialization of payloads transmitted via the Flight protocol used for server-side rendering and server actions. An attacker can craft a malicious payload within an HTTP request to a Server Function endpoint, which, when deserialized on the server, leads to RCE, effectively allowing the attacker to execute arbitrary code without needing any valid session or authentication (00:53). The video highlights the severity with a 10.0 CVSS score and draws comparisons to Log4Shell (00:11, 00:31). Following the public disclosure on December 3, 2025, threat intelligence from Amazon indicated rapid exploitation attempts by China-nexus cyber threat groups like Earth Lamia and Jackpot Panda (02:52). Censys data suggests over 2.15 million internet-facing services running vulnerable configurations could be affected (02:57). The mechanism involves manipulating the Flight protocol's serialization layer, where a fake chunk call resolves with malicious code that executes when JavaScript calls the .then() method (00:51). The video concludes by urging users to update immediately and promotes the sponsor, Genspark, as an AI workspace tool that can assist developers in managing such security issues (03:05, 03:08).