Exploitation of Critical Vulnerability in React Server Components (Updated December 12)
Summary: Unit 42 documented post-exploitation activity following exploitation of CVE-2025-55182, a CVSS 10.0 insecure deserialization flaw in the React Server Components Flight protocol disclosed Dec. 3, 2025, which allows unauthenticated attackers to execute arbitrary code on servers with near-100% exploit reliability and no code changes. Observed activity included automated scanning, Base64-encoded reconnaissance commands, XMRig cryptomining, a Linux dropper, a bash reverse shell to a probable Cobalt Strike server, a fake React File Manager web shell (fm.js), and activity consistent with CL-STA-1015 installing SNOWLIGHT and VShell, alongside a previously unseen Linux backdoor named KSwapDoor.
Key Takeaway: Palo Alto Networks Cortex Xpanse counted over 968,000 React and Next.js instances in its telemetry, and React is used by roughly 40% of all developers - so the population exposed to a no-code-change, near-100%-reliable RCE is enormous, and attackers were already mining crypto and installing backdoors on it within days of disclosure.
Read the original at Unit 42 Palo Alto Networks ↗
- Topics
- Threat Actors & Nation-State
- Mentions
- CVE-2025-55182CVE-2025-66478
- Related
- How to detect React2Shell with Burp Suite Cyber Risks ·Professional / Community 2025.10.7 Cyber Risks ·