Vercel Next.js und React Server Components (React2Shell): Schwachstelle ermöglicht Codeausführung

Summary

Product

Vulnerabilities 2

• Critical 10.0
  CVE-2025-55182 Exploited · Ransomware Public exploit Scanner template EPSS 100%

  React Server Components are Vulnerable to RCE

  A pre-authentication remote code execution vulnerability exists in React Server Components versions 19.0.0, 19.1.0, 19.1.1, and 19.2.0 including the following packages: react-server-dom-parcel, react-server-dom-turbopack, and react-server-dom-webpack. The vul…

  Meta react-server-dom-parcel react-server-dom-turbopack react-server-dom-webpack npm
  Dec 3, 2025

  KEV Dec 5, 2025
• Unscored —
  CVE-2025-66478 Public exploit Rejected

  This CVE is a duplicate of CVE-2025-55182.

  langfuse-3 jitsucom-jitsu-console jitsucom-jitsu-rotor jitsucom-jitsu Wolfi
  Dec 2, 2025

Revision history

1. 2025-12-04 #2

   React2Shell als Referenz aufgenommen, PoC ergänzt, Aktive Ausnutzung durch APT

2. 2025-12-03 #1

   Initiale Fassung

References

• GitHub Advisory Database vom 2025-12-03
  https://github.com/advisories/GHSA-9qr9-h5gf-34mp
• PoC auf GitHub vom 2025-12-03
  https://github.com/joshterrill/CVE-2025-55182-realistic-poc
• NSFOCUS Notice vom 2025-12-03
  https://nsfocusglobal.com/react-next-js-remote-code-execution-vulnerability-cve-2025-55182-cve-2025-66478-notice/
• React2Shell (CVE-2025-55182) vom 2025-12-03
  https://react2shell.com/
• AWS Security Blog vom 2025-12-04
  https://aws.amazon.com/de/blogs/security/china-nexus-cyber-threat-groups-rapidly-exploit-react2shell-vulnerability-cve-2025-55182/