Attackers Exploit React2Shell Vulnerability to Target IT Sector Systems
Active exploitation of a critical vulnerability in React Server Components, identified as CVE‑2025‑55182 (React2Shell), is currently affecting companies across various industry sectors globally. This vulnerability impacts the Flight protocol, which is…
Active exploitation of a critical vulnerability in React Server Components, identified as CVE‑2025‑55182 (React2Shell), is currently affecting companies across various industry sectors globally. This vulnerability impacts the Flight protocol, which is used for client-server communication in React Server Components.
The issue arises from insecure deserialization, where servers accept client data without proper verification, allowing potential remote code execution under certain conditions. Initially identified in December 2025, React2Shell demonstrates the speed at which adversaries can exploit newly disclosed vulnerabilities to deploy diverse malware payloads.
Affected packages include react-server-dom-webpack, react-server-dom-parcel, and react-server-dom-turbopack versions 19.0 through 19.2.0. Patches are available in versions 19.0.1, 19.1.2, and 19.2.1.
BI.ZONE Threat Detection and Response has observed multiple attack waves targeting sectors such as insurance, e-commerce, and IT in Russia, as well as global campaigns affecting organizations elsewhere. Attackers utilize Base64-encoded commands executed within compromised containers to establish persistence via systemd services, cron jobs, and modified startup scripts.
This vulnerability impacts the Flight protocol, which is used for client-server communication in React Server Components.
XMRig Cryptocurrency Miner: Frequently deployed malware installed through Bash scripts (apaches.sh, setup2.sh, sex.sh) that create persistence mechanisms and terminate competing processes consuming excessive CPU resources. Kaiji Botnet: Deployed as architecture-specific ELF executables, this Golang-based botnet performs DDoS attacks, executes arbitrary shell commands, and embeds XMRig. RustoBot: Written in Rust and targeting TOTOLINK devices, this botnet conducts DDoS attacks via UDP, TCP, and raw IP floods. Sliver Implant: An advanced persistent threat tool establishing persistence with root privileges. CrossC2 Framework: Deploys Cobalt Strike beacon payloads for post-exploitation activities. Tactical RMM: Remote monitoring and management tools allowing persistent administrative access. VShell Backdoor: Go-based backdoor using XOR decryption to evade detection. EtherRAT: JavaScript-based remote access trojan targeting cryptocurrency wallets and SSH keys.
Adversaries utilize DNS tunneling to exfiltrate reconnaissance data, employing subdomains to capture command execution results. Reconnaissance scripts gather system information, network configurations, and running processes, exfiltrating data to specified endpoints.
Organizations are advised to immediately update all affected react-server-dom-* packages to patched versions (19.0.1, 19.1.2, 19.2.1 or higher). Projects using Next.js should also be upgraded to include these patched dependencies. After updating, rebuild projects and verify lock files to ensure the removal of vulnerable versions.
Security teams should audit systems for indicators of compromise, specifically connections to known malicious IPs and domains, and monitor for unauthorized systemd services or cron jobs. The rapid weaponization of React2Shell highlights the necessity of immediate patching and continuous monitoring for post-exploitation activities.
Based on reporting by GBHackers.