Critical React4Shell Flaw Lets Attackers Run Commands with Server-Level Privileges

A critical vulnerability in React Server Components has become the target of active exploitation campaigns within hours of public disclosure.

Dubbed React4Shell, CVE-2025-55182 allows unauthenticated attackers to execute arbitrary commands with the privileges of the web application process, read and write files, and deploy malware across vulnerable infrastructure.

The vulnerability affects React Server Components (RSC), a framework feature that optimizes UI rendering by distributing tasks between the client and server.

Researchers published details of the exploit and proof-of-concept code on December 4, 2025, prompting rapid weaponization by threat actors.

Security monitoring platforms began detecting exploitation attempts within 24 hours, with attack volumes escalating significantly by December 8.

Technical Overview

The flaw lies in the Server Actions component of React Server Components, which is categorized as CWE-502 (Deserialization of Untrusted Data).

Attackers exploit the vulnerability by sending a POST request containing a malicious serialized data payload to the vulnerable server.

The handler’s unsafe deserialization mechanism fails to validate input, thereby enabling code execution.

The vulnerability impacts react-server-dom-webpack, react-server-dom-parcel, and react-server-dom-turbopack versions 19.0.0 through 19.2.0, as well as dependent frameworks including Next.js, React Router, Waku, and others.

Kaspersky’s honeypot telemetry reveals attackers follow a consistent exploitation methodology.

After achieving code execution, threat actors conduct reconnaissance using commands such as whoami, bash arithmetic operations, or hash computations to verify that the target is not a honeypot.

Subsequent payload delivery typically utilizes wget or curl to download malicious binaries.

Threat actors have rapidly integrated the vulnerability into multiple malware campaigns.

RondoDox botnet variants demonstrate sophisticated post-exploitation behavior, including eliminating competing malware processes, disabling security modules (AppArmor and SELinux), and deploying polyglot malware builds targeting both IoT devices and x86_64 servers.

Additional threats include classic Mirai/Gafgyt variants, XMRig crypto miners, and credential theft operations targeting Git and cloud environment credentials.

Organizations should immediately apply available patches from React component maintainers.

Until patches are deployed, implement POST request filtering to block parameters and request bodies containing the keywords: #constructor, #proto, #prototype, vm#runInThisContext, vm#runInNewContext, child_process#execSync, child_process#execFileSync, child_process#spawnSync, module#_load, module#createRequire, fs#readFileSync, fs#writeFileSync, and fs#appendFileSync.

Additional mitigation includes scanning vulnerable systems for malware indicators, rotating any credentials stored on compromised hosts, and implementing network segmentation to limit lateral movement following exploitation.

The combination of publicly available exploits and straightforward exploitation mechanics has accelerated threat actor adoption.

Security researchers anticipate continued escalation in attack volume during the coming weeks, making rapid patching and defensive measures essential for organizations utilizing React Server Components in production environments.

Find this Story Interesting! Follow us on Google News, LinkedIn and X to Get More Instant Update