React2Shell: unauthenticated RCE in React Server Components
Free public brief. The indicators, the detections with Splunk SPL already written (plus Elastic and KQL where they apply), and a Slack alert the next time this touches a vendor you run are in the app — free account, no card.
Unauthenticated remote code execution in React Server Components via unsafe deserialization; actively exploited by Chinese threat actors.
A critical vulnerability in React Server Components (RSC) Flight protocol allows unauthenticated remote code execution through unsafe deserialization of attacker-controlled payloads. CVE-2025-55182 enables an attacker to craft a malicious HTTP request containing serialized Flight data that causes the server to deserialize arbitrary objects and execute code. No authentication, session, or user interaction is required for successful exploitation. Chinese threat actor groups have been observed actively exploiting this vulnerability in the wild.
Affected versions include React prior to 19.0.1, 19.1.2, and 19.2.1, as well as Next.js 15.x and 16.x prior to their respective patched releases. Any frameworks or tools bundling vulnerable React Server Components are also affected. Defenders must apply patches immediately and implement network segmentation, vulnerability scanning, and least-privilege access controls to limit the blast radius of potential compromise.
Mentioned in this report
Detection guidance
Node.js Process Spawning Shell With Recon or Download Commands (Linux)
Detects a Node.js server process (e.g. Next.js/React Server Components host) spawning a shell that runs recon or download-and-execute commands, consistent with post-exploitation of unauthenticated RCE such as CVE-2025-55182. Auto-generated starting point — validate and tune in your environment before deploying. IOC matches can false-positive on shared infrastructure and decay as adversary infrastructure rotates.
title: Node.js Process Spawning Shell With Recon or Download Commands (Linux)
description: Detects a Node.js server process spawning sh/bash that runs reconnaissance
or download-and-execute commands. This is the typical post-exploitation footprint
of unsafe deserialization RCE in React Server Components (CVE-2025-55182). Generalises
on the parent/child relation and command content, not on specific payloads.
tags:
- attack.initial-access
- attack.t1190
logsource:
category: process_creation
product: linux
detection:
selection_parent:
ParentImage|endswith:
- /node
- /nodejs
- /next-server
selection_child:
Image|endswith:
- /sh
- /bash
- /dash
selection_cmd:
CommandLine|contains:
- 'curl '
- 'wget '
- whoami
- id;
- uname -a
- /etc/passwd
- /etc/shadow
- base64 -d
- chmod +x
condition: selection_parent and selection_child and selection_cmd
falsepositives:
- Node.js based deployment or health-check scripts that shell out to curl or wget
- Developer tooling on build servers invoking shell commands from node
level: high
id: c9413e8c-3082-5dd1-a853-ca4fad6557b3
status: experimental
author: Vorant
references:
- https://www.cisecurity.org/advisory/a-vulnerability-in-react-server-component-rsc-could-allow-for-remote-code-execution_2025-111
Node.js Process Spawning Command Interpreter on Windows
Detects node.exe hosting a web application spawning cmd.exe or PowerShell with recon or download cradle content, indicating RCE exploitation of a server-side JavaScript app. Auto-generated starting point — validate and tune in your environment before deploying. IOC matches can false-positive on shared infrastructure and decay as adversary infrastructure rotates.
title: Node.js Process Spawning Command Interpreter on Windows
description: Detects node.exe spawning cmd.exe or PowerShell with reconnaissance,
download or encoded-command content. Consistent with exploitation of React Server
Components deserialization RCE (CVE-2025-55182) on Windows-hosted Next.js servers.
tags:
- attack.initial-access
- attack.t1190
logsource:
category: process_creation
product: windows
detection:
selection_parent:
ParentImage|endswith: \node.exe
selection_child:
Image|endswith:
- \cmd.exe
- \powershell.exe
- \pwsh.exe
selection_cmd:
CommandLine|contains:
- whoami
- net user
- net group
- certutil
- bitsadmin
- Invoke-WebRequest
- DownloadString
- 'iwr '
- -enc
- curl
condition: selection_parent and selection_child and selection_cmd
falsepositives:
- Node.js build or deployment scripts that call PowerShell to download dependencies
- Developer machines running local node tooling with curl invocations
level: high
id: c3d60c70-6f7e-5a4e-934b-bab33eefb3ef
status: experimental
author: Vorant
references:
- https://www.cisecurity.org/advisory/a-vulnerability-in-react-server-component-rsc-could-allow-for-remote-code-execution_2025-111
Node.js Process Spawning Reverse Shell Pattern (Linux)
Detects a Node.js server process spawning a shell with reverse shell constructs, a common follow-on to web application RCE. Auto-generated starting point — validate and tune in your environment before deploying. IOC matches can false-positive on shared infrastructure and decay as adversary infrastructure rotates.
title: Node.js Process Spawning Reverse Shell Pattern (Linux)
description: Detects a Node.js process launching a shell or utility with reverse-shell
constructs such as /dev/tcp, mkfifo or nc -e. Follow-on behaviour after RCE in a
public-facing React/Next.js server.
tags:
- attack.initial-access
- attack.t1190
logsource:
category: process_creation
product: linux
detection:
selection_parent:
ParentImage|endswith:
- /node
- /nodejs
- /next-server
selection_cmd:
CommandLine|contains:
- /dev/tcp/
- mkfifo
- nc -e
- ncat -e
- bash -i
- socat exec
condition: selection_parent and selection_cmd
falsepositives:
- Security testing or red team exercises against node hosts
level: critical
id: 26de0c74-9e7f-56bc-aaac-5a359c40b40e
status: experimental
author: Vorant
references:
- https://www.cisecurity.org/advisory/a-vulnerability-in-react-server-component-rsc-could-allow-for-remote-code-execution_2025-111
Behavioural rules are generated from public reporting — validate in your environment before deploying.
Source reporting: https://www.cisecurity.org/advisory/a-vulnerability-in-react-server-component-rsc-could-allow-for-remote-code-execution_2025-111
What this brief leaves out
This page is the free tier: the write-up, the severity, the names. In the app the same report carries its extracted indicators, its detections (Splunk SPL already written, plus Elastic and Microsoft KQL where they apply), the actors and CVEs it names as live profiles, and the vendor research on the same campaign — the primary source the news paraphrased, cited and read directly.
It sits in a corpus of 13,853 reports from 146 sources, 616 of them written in the last seven days, and it grows through the day.
A new account starts with three days of all of it, no card, then keeps the government and CERT reporting free. Name the vendors you run and Slack hears about the reports that touch them — about forty a week that are yours, not the four hundred that are not.
Create a free account What it costs