Threats tagged 'rsc'

CVE-2025-55182, known as React2Shell, is a critical Remote Code Execution vulnerability affecting React Server Components (RSC) and related frameworks such as Next.js, Waku, and Vite. It arises from improper input deserialization in RSC payloads, enabling attackers to execute arbitrary code. Exploitation has been observed in cloud environments targeting containerized workloads, facilitating initial access, credential theft, cryptomining, and deployment of advanced backdoors. Public exploit code is available, and the vulnerability is actively exploited in the wild, including use in ransomware campaigns. No specific affected versions or patch information is provided. Detection templates exist to aid identification of exploitation attempts.