The CVE-2025-55182 vulnerability in React Server Components, also known as React2Shell, exposes a critical security weakness arising from insecure deserialization in the RSC “Flight” protocol.  

This vulnerability enables attackers to achieve unauthenticated remote code execution on a target server simply by sending a specially crafted HTTP request.  

The flaw effectively turned a core rendering mechanism of modern React and Next.js applications into a silent execution path for attacker-controlled code. 

Jump into the campaign to learn everything you need to know about this critical vulnerability. 

Understanding React2Shell vulnerability 

The core weakness of React2Shell is the insecure deserialization in the React Server Components (RSC) “Flight” protocol. 

This flaw allows malformed RSC payloads to influence server-side execution logic during rendering, effectively collapsing the trust boundary between untrusted input and executable code.  

What’s more, the default implementation of React Server Components does not enforce sufficient validation, isolation, or integrity checks on incoming RSC payloads before execution.  

The potential exploits and attack outcomes also vary, making detection a challenge. Attackers and exploit React2Shell to achieve: 

• Remote code execution 

• Cloud credential theft 

• Resource abuse & crypto mining 

• Targeted activation & anti-analysis 

• Escalation & lateral opportunities 

Anatomy of the attack chain 

The attack chain of the React2Shell exploitation unfolds methodically. 

1. Initial entry point: Delivery of a crafted, unauthenticated HTTP request to an internet-facing React or Next.js application using React Server Components. 

2. Exploitation technique: Abuse of insecure deserialization in the RSC “Flight” payload handling logic, allowing attacker-controlled data to influence server-side execution flow. 

3. Impact: Remote code execution on the server, followed by credential harvesting, cloud environment compromise, and post-exploitation activity such as crypto mining and malware deployment. 

What you’ll learn 

Recognizing the severity of this vulnerability is essential for defenders.  

Although hardened releases of React and Next.js were made available shortly after disclosure, the campaign demonstrated how quickly attackers can weaponize deserialization flaws in widely deployed frameworks.  

In this spotlight, you’ll learn: 

• The detailed anatomy and technical analysis of the React2Shell vulnerability and attack chain 

• Specific evasion techniques  

• Defense and mitigation strategies 

Access this campaign and a dedicated React2Shell hands-on lab for free and put theory into practice!