LiveThreat Vulnerability Brief — CVE-2025-55182 (React2Shell)
What It Is — CVE‑2025‑55182 is a critical deserialization flaw (CWE‑502) in Meta’s React Server Components that enables remote code execution when malicious payloads are processed by the server‑side rendering pipeline.
Exploitability — Active exploitation was observed worldwide in December 2025; public proof‑of‑concept code is available, and threat actors have weaponized the bug in multiple malware families (collectively dubbed “React2Shell”). CVSS v3.1 base score: 10.0 (Critical).
Affected Products — Meta React Server Components (used by a broad range of SaaS and web‑application providers).
TPRM Impact — Any third‑party service that integrates React Server Components inherits the same remote‑code‑execution risk, creating a supply‑chain attack surface that can compromise downstream customers, data pipelines, and hosted services.
Recommended Actions —
- Immediately inventory all applications and services that embed Meta’s React Server Components.
- Apply Meta‑provided patches or upgrade to the latest, patched version of the framework.
- Conduct rapid code‑review of server‑side rendering paths for untrusted input handling.
- Deploy web‑application firewalls (WAF) with rules to block known React2Shell payload signatures.
- Communicate the risk and remediation status to all affected vendors and downstream partners.