React2Shell Vulnerability Under Widespread Attack Less Than a Week After Disclosure

React2Shell vulnerability (CVE-2025-55182) poses critical threats with rampant exploitation; urgent patching advised for React apps.

By Content Team

Dec 9, 2025

ON THIS PAGE

Want more insights like this?

Subscribe to our newsletter to get the latest software protection strategies delivered to your inbox.

By submitting your email, you consent to Codekeeper contacting you and agree to our privacy policy.

A critical React vulnerability dubbed React2Shell (CVE-2025-55182) is facing massive exploitation just days after its December 3rd disclosure. The maximum severity flaw earned a perfect 10 CVSS score and enables remote code execution in React applications.

China-linked threat groups began attacking within hours, but exploitation has now exploded across the threat landscape. Security firm Wiz documented attacks ranging from cryptomining to sophisticated backdoor campaigns targeting Next.js applications and Kubernetes environments. VulnCheck reported hundreds of exploit attempts by December 6th.

Over 2.1 million exposed web services run vulnerable frameworks, with the US leading exposure counts. While web application firewalls offer some protection, researchers warn bypass techniques exist. Organizations must prioritize patching over temporary mitigations.

Source: Dark Reading

Have questions about protecting your software?

Our escrow experts are standing by to help.

Book a free demo