React Server Components remote code execution (React2Shell)
Summary: PortSwigger Research reports that React Server Components and Next.js carry critical remote code execution vulnerabilities tracked as CVE-2025-55182 (React) and CVE-2025-66478 (Next.js), with a CVSS score of 10.0. The flaw allows unauthenticated attackers to execute arbitrary code on the server, and the source's guidance is to patch immediately by upgrading to patched versions.
Key Takeaway: A CVSS 10.0 unauthenticated remote code execution bug in React Server Components means anyone who can reach your app can run code on the server, with no credentials required - and the only remediation the source offers is upgrading to patched versions.
Read the original at PortSwigger Research ↗
- Topics
- Vulnerabilities & Patching
- Mentions
- CVE-2025-55182CVE-2025-66478
- Related
- How to detect React2Shell with Burp Suite Cyber Risks ·Professional / Community 2025.10.7 Cyber Risks ·Professional / Community 2025.11.3 Cyber Risks ·