A maximum-severity security hole has been revealed in React Server Components (RSC) that, if successfully exploited, might result in remote code execution.
The vulnerability has a CVSS score of 10.0 and is tagged as CVE-2025-55182. React2shell is the code name for the vulnerability.
In an advisory released today, the React Team stated that it exploits a vulnerability in the way React decodes payloads submitted to React Server Function endpoints, allowing unauthenticated remote code execution.
If your application supports React Server Components, it can be susceptible even if it doesn’t implement any React Server Function endpoints.
The problem is a case of logical deserialization that results from processing RSC payloads in an unsafe way, according to cloud security company Wiz read more about Critical RSC Bugs in React and Next.js Allow Unauthenticated Remote Code Execution.
Get up to date on the latest cybersecurity news and enhance your knowledge of cybersecurity with our thorough coverage of the dangers, breaches, and solutions.