oss-sec mailing list archives

React2Shell (CVE-2025-55182/CVE-2025-66478)

From: Jeffrey Walton <noloader () gmail com>
Date: Thu, 4 Dec 2025 12:24:02 -0500

A new RCE dropped last night -- React2Shell
(CVE-2025-55182/CVE-2025-66478).  The vulnerabilities kicked-off a
fire drill at $dayjob.

More reading at:

* CVE-2025-55182,
<https://react.dev/blog/2025/12/03/critical-security-vulnerability-in-react-server-components>
* CVE-2025-66478,
<https://github.com/vercel/next.js/security/advisories/GHSA-9qr9-h5gf-34mp>

Current thread:

React2Shell (CVE-2025-55182/CVE-2025-66478) Jeffrey Walton (Dec 04)