Professional / Community 2025.10.7
Summary: PortSwigger released Burp Suite Professional/Community 2025.10.7 on 8 December 2025, adding a new active scan check for React2Shell, a critical remote code execution vulnerability affecting React Server Components in React and Next.js, tracked as CVE-2025-55182 and CVE-2025-66478. The check is enabled by default and runs once per host, and the release also upgrades Burp's browser to Chromium 143.0.7499.41 on Windows and Mac and 143.0.7499.40 on Linux.
Why it matters: React2Shell is a critical remote code execution flaw in React Server Components and Next.js, and the scanner check that detects it runs by default once per host - so any host you have not scanned since this release carries an untested exposure to code execution.
Read the original at PortSwigger Research ↗
- Topics
- Vulnerabilities & Patching
- Mentions
- CVE-2025-55182CVE-2025-66478
- Related
- How to detect React2Shell with Burp Suite Cyber Risks ·Professional / Community 2025.11.3 Cyber Risks ·