React2Shell exploitation with ransomware and broad probing
Case score 71
Case score is a discovery signal based on public evidence, not a guaranteed risk rating. Use it to decide what to review first, then verify important details from the linked sources.
- Total
- 71
- Main story score
- 64
- Related evidence lift
- +7 / 20
- Contributing updates
- 3
- Context updates
- 1
- Exploitation Wave Core exploitation wave and principal activity. main
- Campaign Shows the flaw used to deliver EtherRAT and maintain persistent access. contributes
- Campaign Shows rapid multi-CVE scanning and early exploitation by named actors. contributes
- Security Patch Release Provides the fixed React Server Components package line and remediation path. context
Overview
Latest development Open development history React2Shell exploitation deploys Weaxor ransomware On December 5, 2025, a threat actor exploited CVE-2025-55182 against a React/Next.js-based system at the affected organization, gained initial access, and deployed Weaxor ransomware less than a minute later. The attacker then executed an obfuscated PowerShell command to launch a Cobalt Strike beacon, disabled Windows Defender real-time protection, wiped volume shadow copies, cleared event logs, and left files with the .WEAX extension alongside RECOVERY INFORMATION.txt ransom notes.
-
React Team issues alert on unauthenticated RCE in React Server Components
React Team alerts users that CVE-2025-55182 allows unauthenticated remote code execution by exploiting a flaw in how React decodes payloads sent to React Server Function endpoints, while Wiz characterizes the issue as logical deserialization from unsafe RSC payload processing; the scope also includes Next.js using App Router and CVE-2025-66478 with a CVSS score of 10.0.
-
React Server Components source code leak fixes
React team released fixes for React Server Components vulnerabilities affecting react-server-dom-parcel, react-server-dom-turbopack, and react-server-dom-webpack, including CVE-2025-55183, an information leak that can cause a crafted HTTP request sent to a vulnerable Server Function to return the source code of any Server Function. Successful exploitation requires a Server Function that explicitly or implicitly exposes an argument converted into a string, and operators are advised to upgrade to 19.0.3, 19.1.4, or 19.2.3.
-
React2Shell scanning and targeting expand worldwide
An unknown, possibly state-sponsored threat actor uses the ILovePoop toolkit to probe tens of millions of IP addresses worldwide for exposed React systems, with targeting that includes government, defense, finance, and industrial organizations, while researchers assess the actor may be involved in state-sponsored espionage and note that React2Shell has also appeared in ransomware campaigns and other botnet activity.
-
Security researcher reports CVE-2025-55182 in React Server Components
New Zealand-based security researcher Lachlan Davidson discovers and reports CVE-2025-55182, a maximum-severity flaw in React Server Components that can enable unauthenticated remote code execution through unsafe decoding of RSC payloads in react-server-dom-webpack, react-server-dom-parcel, and react-server-dom-turbopack.
-
AWS sees React2Shell exploitation and multi-CVE scanning
AWS MadPot honeypot telemetry identified Earth Lamia and Jackpot Panda attempting to exploit CVE-2025-55182 (React2Shell) in React Server Components (RSC) within hours of disclosure, and also saw attempts against CVE-2025-1338 in NUUO Camera and other N-day flaws. The observed activity included discovery commands such as whoami, writing /tmp/pwned.txt, and reading /etc/passwd, indicating rapid public-exploit adoption and broad scanning for unpatched systems.
-
December 3 disclosure of CVE-2025-55182 in React Server Components
Public disclosure identifies CVE-2025-55182 as a maximum-severity remote code execution vulnerability in React Server Components that affects React version 19 and related frameworks including Next.js, Waku, React Router and RedwoodSDK.