React2Shell: In-the-Wild Exploitation Expected for Critical React Vulnerability
A researcher has pointed out that only instances using a newer feature are impacted by CVE-2025-55182. The post React2Shell: In-the-Wild Exploitation Expected for Critical React Vulnerability appeared first on SecurityWeek.
The cybersecurity industry is on high alert following the disclosure of a critical React vulnerability that can be exploited by a remote, unauthenticated attacker for remote code execution.
React (React.js) is an open source JavaScript library designed for creating application user interfaces. Maintained by Meta and a large community of companies and individual developers from around the world, React is widely used: it reportedly powers millions of websites, it’s used by popular online services (Airbnb, Instagram, Netflix), and its core NPM package currently has 55 million weekly downloads.
In an advisory published on Wednesday, React developers informed users about the availability of patches for CVE-2025-55182, an unauthenticated remote code execution vulnerability that has been assigned a CVSS score of 10.
Related breach coverage
- Exploitation of React2Shell Surges2025-12-08
An increasing number of threat actors have been attempting to exploit the React vulnerability CVE-2025-55182 in their attacks. The post Exploitation of React2Shell Surges appeared first on SecurityWeek.
- Cloudflare Outage Caused by React2Shell Mitigations2025-12-05
The critical React vulnerability has been exploited in the wild by Chinese and other threat actors. The post Cloudflare Outage Caused by React2Shell Mitigations appeared first on SecurityWeek.
- Chinese Hackers Exploiting React2Shell Vulnerability2025-12-05
AWS has seen multiple China-linked threat groups attempting to exploit the React vulnerability CVE-2025-55182. The post Chinese Hackers Exploiting React2Shell Vulnerability appeared first on SecurityWeek.
- Rockwell Vulnerability Allowing Remote ICS Hacking Exploited in Attacks2026-03-06
The vulnerability was disclosed and mitigated in 2021 but its in-the-wild exploitation has only now come to light. The post Rockwell Vulnerability Allowing Remote ICS Hacking Exploited in Attacks appeared first on SecurityWeek.