How to detect React2Shell with Burp Suite
Summary: PortSwigger released two updates on December 5, 2025, so that default scans in both versions of Burp Suite can detect React2Shell (CVE-2025-55182 and CVE-2025-66478) in Next.js applications without extensions, custom checks, or scripts. The two critical vulnerabilities carry a CVSS score of 10.0 with unauthenticated remote code execution, affect React and Next.js applications and potentially other frameworks using React server components, and are expected to follow a trajectory similar to Log4j, including rapid weaponization by ransomware groups.
What you should know: A CVSS 10.0 unauthenticated RCE in frameworks that underpin a huge number of production apps is expected to be weaponized rapidly by ransomware groups, and PortSwigger notes that an application may still be vulnerable even if it does not explicitly call server actions, as long as it supports React server components.
Read the original at PortSwigger Research ↗
- Topics
- Vulnerabilities & Patching
- Mentions
- CVE-2025-55182CVE-2025-66478
- Related
- Professional / Community 2025.10.7 Cyber Risks ·Professional / Community 2025.11.3 Cyber Risks ·