Page generated: 08 Nov 2026, 06:54 UTC
← Dashboard

CVE-2025-55182

React2Shell

A pre-authentication remote code execution vulnerability exists in React Server Components versions 19.0.0, 19.1.0, 19.1.1, and 19.2.0 including the following packages: react-server-dom-parcel, react-server-dom-turbopack, and react-server-dom-webpack. The vulnerable code unsafely…

Read full description
A pre-authentication remote code execution vulnerability exists in React Server Components versions 19.0.0, 19.1.0, 19.1.1, and 19.2.0 including the following packages: react-server-dom-parcel, react-server-dom-turbopack, and react-server-dom-webpack. The vulnerable code unsafely deserializes payloads from HTTP requests to Server Function endpoints.
CVSS 10.0 (CRITICAL) KEV: KNOWN CATALOG

Attention and evidence

HYPE SCORE
3.8/10
REALITY · THREAT PRIORITY
9.0/10
General review priority; not probability

Evidence confidence: Exploitation recorded

Why this priority?
  • Recorded exploitation baseline: +7.00
  • Technical severity: CVSS 10: +1.50
  • Fresh EPSS: 99.73%: +0.50

General review priority, not probability, victim count or asset-specific risk. A range covers missing CVSS/EPSS inputs within the current evidence state.

Sources: 50 documents and public datasets.

Hype components

Headline sample (25%)
80/100
Press, 30 days (60%)
5/100
Grounded branding (15%)
100/100
HYPE TOTAL38/100

Sources and documents

Aikido Security
Press · 30 Oct 2026, 03:27 · What are shell vulnerabilities? PHP2Shell, Node2Shell (HTTP2Shell), React2Shell and Log4Shell explained - Aikido Security
Barracuda Blog
Press · 03 Sep 2026, 07:00 · Barracuda Application Protection safeguards against critical React and Next.js vulnerabilities - Barracuda Blog
Recorded Future
Press · 07 Aug 2026, 07:00 · July 2026 CVE Landscape - Recorded Future
Cybersecurity Dive
Press · 07 Apr 2026, 07:00 · React2Shell vulnerability helps hackers steal credentials, AI platform keys and other sensitive data - Cybersecurity Dive
Dark Reading
Press · 06 Apr 2026, 07:00 · Automated Credential Harvesting Campaign Exploits React2Shell Flaw - Dark Reading
See all 50 source documents
BleepingComputer
Press · 05 Apr 2026, 07:00 · Hackers exploit React2Shell in automated credential theft campaign - BleepingComputer
SecurityWeek
Press · 03 Apr 2026, 07:00 · React2Shell Exploited in Large-Scale Credential Harvesting Campaign - SecurityWeek
Cisco Talos Blog
Press · 02 Apr 2026, 07:00 · UAT-10608: Inside a large-scale automated credential harvesting operation targeting web applications - Cisco Talos Blog
The Hacker News
Press · 02 Apr 2026, 07:00 · Hackers Exploit CVE-2025-55182 to Breach 766 Next.js Hosts, Steal Credentials - The Hacker News
Darktrace
Press · 10 Feb 2026, 08:00 · AI/LLM-Generated Malware Used to Exploit React2Shell - Darktrace
The Hacker News
Press · 05 Feb 2026, 08:00 · Malicious NGINX Configurations Enable Large-Scale Web Traffic Hijacking Campaign - The Hacker News
Cybersecurity Dive
Press · 04 Feb 2026, 08:00 · React2Shell exploitation undergoes significant change in threat activity - Cybersecurity Dive
GreyNoise
Press · 02 Feb 2026, 08:00 · React Server Components Exploitation Consolidates as Two IPs Generate Majority of Attack Traffic - GreyNoise
Recorded Future
Press · 13 Jan 2026, 08:00 · December 2025 CVE Landscape: 22 Critical Vulnerabilities Mark 120% Surge, React2Shell Dominates Threat Activity - Recorded Future
SecurityWeek
Press · 02 Jan 2026, 08:00 · RondoDox Botnet Exploiting React2Shell Vulnerability - SecurityWeek
Rescana
Press · 31 Dec 2025, 08:00 · RondoDox Botnet Actively Exploits React2Shell Vulnerability (CVE-2025-55182) in Next.js and React Server Components - Rescana
Resecurity
Press · 24 Dec 2025, 08:00 · React2Shell Explained (CVE-2025-55182): From Vulnerability Discovery to Exploitation - Resecurity
Bitsight
Press · 18 Dec 2025, 08:00 · CVE-2025-55182: First Days of React2Shell Exploitations - Bitsight
CyberScoop
Press · 17 Dec 2025, 08:00 · React2Shell fallout spreads to sensitive targets as public exploits hit all-time high - CyberScoop
The Hacker News
Press · 16 Dec 2025, 08:00 · React2Shell Vulnerability Actively Exploited to Deploy Linux Backdoors - The Hacker News
Microsoft
Press · 15 Dec 2025, 08:00 · Defending against the CVE-2025-55182 (React2Shell) vulnerability in React Server Components - Microsoft
Google Cloud
Press · 12 Dec 2025, 08:00 · Multiple Threat Actors Exploit React2Shell (CVE-2025-55182) - Google Cloud
Unit 42
Press · 12 Dec 2025, 08:00 · Exploitation of Critical Vulnerability in React Server Components (Updated December 12) - Unit 42
Securelist
Press · 11 Dec 2025, 08:00 · Attacks on Kaspersky honeypots exploit CVE-2025-55182 - Securelist
Cloudflare Blog
Press · 11 Dec 2025, 08:00 · React2Shell and related RSC vulnerabilities threat brief: early exploitation activity and threat actor techniques - Cloudflare Blog
Sophos
Press · 11 Dec 2025, 08:00 · React2Shell flaw (CVE-2025-55182) exploited for remote code execution - Sophos
OX Security
Press · 11 Dec 2025, 08:00 · React2Shell | Going Granular: A Deep-Deep-Deep Technical Analysis of CVE-2025-55182 - OX Security
www.trendmicro.com
Press · 10 Dec 2025, 08:00 · CVE-2025-55182: React2Shell Analysis, Proof-of-Concept Chaos, and In-the-Wild Exploitation - www.trendmicro.com
Huntress
Press · 09 Dec 2025, 08:00 · PeerBlight Linux Backdoor Exploits React2Shell CVE-2025-55182 - Huntress
Recorded Future
Press · 08 Dec 2025, 08:00 · Critical React2Shell Vulnerability Under Active Exploitation by Chinese Threat Actors - Recorded Future
wiz.io
Press · 08 Dec 2025, 08:00 · React2Shell: Technical Deep-Dive & In-the-Wild Exploitation of CVE-2025-55182 - wiz.io
SecurityWeek
Press · 05 Dec 2025, 08:00 · Chinese Hackers Exploiting React2Shell Vulnerability - SecurityWeek
Infosecurity Magazine
Press · 05 Dec 2025, 08:00 · React.js Hit by Maximum-Severity 'React2Shell' Vulnerability - Infosecurity Magazine
GreyNoise
Press · 05 Dec 2025, 08:00 · CVE-2025-55182 (React2Shell) Opportunistic Exploitation In The Wild: What The GreyNoise Observation Grid Is Seeing So Far - GreyNoise
Check Point Blog
Press · 05 Dec 2025, 08:00 · What is “React2Shell” (CVE-2025-55182) - in Plain English - and Why Check Point CloudGuard WAF Customers Carried on with Their Day - Check Point Blog
www.trendmicro.com
Press · 05 Dec 2025, 08:00 · Critical React Server Components Vulnerability CVE-2025-55182: What Security Teams Need to Know - www.trendmicro.com
OX Security
Press · 05 Dec 2025, 08:00 · React’s CVE-2025-55182 Is Now Actively Exploitable: Verified PoC - OX Security
www.trendmicro.com
Press · 05 Dec 2025, 08:00 · Critical React Server Components Vulnerability CVE-2025-55182: What Security Teams Need to Know - www.trendmicro.com
CERT-FR
Technical advisory · 05 Dec 2025, 00:00 · [MàJ] Vulnérabilité dans React Server Components (05 décembre 2025)
CERT-FR
Press · 05 Dec 2025, 00:00 · [MàJ] Vulnérabilité dans React Server Components (05 décembre 2025)
SecurityWeek
Press · 04 Dec 2025, 08:00 · React2Shell: In-the-Wild Exploitation Expected for Critical React Vulnerability - SecurityWeek
Sonatype
Press · 04 Dec 2025, 08:00 · Serious React2Shell Vulnerabilities Require Immediate Attention - Sonatype
Bitdefender
Press · 04 Dec 2025, 08:00 · Technical Advisory: React2Shell Critical Unauthenticated RCE in React (CVE-2025-55182) - Bitdefender
Bitsight
Press · 04 Dec 2025, 08:00 · CVE-2025-66478, CVE-2025-55182 React2Shell Exploits: Details - Bitsight
Google Cloud
Press · 04 Dec 2025, 08:00 · Responding to CVE-2025-55182: Secure your React and Next.js workloads - Google Cloud
Rapid7
Press · 04 Dec 2025, 08:00 · React2Shell (CVE-2025-55182) - Critical unauthenticated RCE affecting React Server Components - Rapid7
Amazon Web Services (AWS)
Press · 04 Dec 2025, 08:00 · China-nexus cyber threat groups rapidly exploit React2Shell vulnerability (CVE-2025-55182) - Amazon Web Services (AWS)
SentinelOne
Press · 03 Dec 2025, 08:00 · From React to Remote Code – Protecting Against the Critical React2Shell RCE Exposure - SentinelOne
wiz.io
Press · 03 Dec 2025, 08:00 · React2Shell (CVE-2025-55182): Everything You Need to Know About the Critical React Vulnerability - wiz.io
The Hacker News
Press · 03 Dec 2025, 08:00 · Critical RSC Bugs in React and Next.js Allow Unauthenticated Remote Code Execution - The Hacker News

Score evolution

● Hype   ● Reality

Earlier evidence-support scores are retained in history; this chart shows only the current priority definition.

First record: hype 3.8 · reality 9.0 (2026-11-02 15:13). The curve appears once the score changes.

Public exploit evidence

113

Public exploit entries / repo candidates

See 30 repos with metrics
RepositoryStarsForksLanguageUpdated
msanft/CVE-2025-551821,432195Python08 Dec 2025, 13:51
lachlan2k/React2Shell-CVE-2025-55182-original-poc1,064111JavaScript05 Dec 2025, 08:56
ejpir/CVE-2025-55182-research790199JavaScript08 Dec 2025, 21:21
emredavut/CVE-2025-5518231454JavaScript06 Dec 2025, 01:27
whiteov3rflow/CVE-2025-55182-poc9534Python03 Jan 2026, 10:54
l4rm4nd/CVE-2025-551828726JavaScript11 Dec 2025, 10:39
sumanrox/rschunter3710Python07 Dec 2025, 15:27
surajhacx/react2shellpoc349Python07 Dec 2025, 17:17
aliclub0x00/CVE-2025-55182-POC-NEXTJS260—05 Dec 2025, 11:15
kOaDT/poc-cve-2025-55182173TypeScript22 Mar 2026, 19:27
AliHzSec/CVE-2025-55182151Python08 Dec 2025, 17:03
acheong08/CVE-2025-55182-poc131Shell05 Dec 2025, 00:07
shamo0/react2shell-PoC102—04 Dec 2025, 16:54
nehkark/CVE-2025-5518293Python05 Dec 2025, 22:07
p3ta00/react2shell-poc91Python24 May 2026, 16:13
AdityaBhatt3010/React2Shell-CVE-2025-55182-The-Deserialization-Bug-That-Broke-the-Web80Python18 Dec 2025, 09:31
jensnesten/React2Shell-PoC82Python05 Jan 2026, 14:07
zzhorc/CVE-2025-5518282Python05 Dec 2025, 17:16
alsaut1/react2shell-lab70Python05 Dec 2025, 21:25
EynaExp/CVE-2025-55182-POC61Python05 Dec 2025, 10:04
keklick1337/CVE-2025-55182-golang-PoC61Go13 Dec 2025, 14:27
raivenLockdown/WEB-CLI_RCE_React2Shell60Python31 May 2026, 10:29
CirqueiraDev/MassExploit-CVE-2025-5518250Python06 Dec 2025, 18:34
kondukto-io/vulnerable-next-js-poc51Shell28 Jan 2026, 15:49
pkrasulia/CVE-2025-55182-NextJS-RCE-PoC51JavaScript10 Dec 2025, 23:16
Tiger-Foxx/exploit-react-CVE-2025-5518250JavaScript11 Dec 2025, 09:12
xiaopeng-ye/react2shell-detector51TypeScript08 Dec 2025, 18:49
c0rydoras/CVE-2025-5518240TypeScript05 Dec 2025, 19:57
RavinduRathnayaka/CVE-2025-55182-PoC42Python18 Dec 2025, 19:55
timsonner/React2Shell-CVE-2025-5518232Python08 Dec 2025, 01:34
Public exploit evidence
Evidence context and dated references

Reality is general threat/review priority, combining observed exploitation, CVSS severity and fresh EPSS. Evidence confidence is separate. This is not calibrated risk, a victim count or an asset-specific assessment. A range reflects missing numeric inputs.

Evidence in context

Confidence in exploitation evidence
Exploitation recorded
Priority basis
Recorded exploitation; CVSS 10; EPSS 99.7%
Attention, last 30 days
1 distinct story titles; 1 press documents; 1 publisher domains.
Technical potential
network access, no prior privileges, no user interaction.
Observed activity
Exploitation recorded in CISA KEV.
Known scale
Not quantified.
Evidence confidence basis
Trusted exploitation confirmation

Score evaluated: 2026-11-05 13:59:41.296531+00:00 · EPSS snapshot: 2026-11-05T12:03:04Z

Source event timeline
First press mention
03 Dec 2025, 08:00
Published
03 Dec 2025, 15:40
Added to the CISA KEV catalog
05 Dec 2025, 00:00
Latest press mention
30 Oct 2026, 03:27
Score calculated
05 Nov 2026, 13:59
Name
React2Shell
PoCs on GitHub
113 repositories