React2Shell fallout spreads to sensitive targets as public exploits hit all
Vulnerabilities mentioned
All| CVE | Vulnerability | CVSS | EPSS | Signals | Published |
|---|---|---|---|---|---|
| CVE-2025-55182 | Unauthenticated RCE in React Server Components (React2Shell) | 10.0 | 100% | KEVRansomwarePoC ×13 | KEV |
| CVE-2025-55183 | Unauthenticated source code exposure in React Server Components 19.x (incl. Next.js) | 5.3 | 64% | PoC | |
| CVE-2025-55184 | Unauthenticated Denial-of-Service in React Server Components 19.x and Next.js | 7.5 | 67% | ||
| CVE-2025-67779 | It was found that the fix addressing CVE-2025-55184 in React Server Components was incomplete and does not prevent a denial of service attack in a specific case | 7.5 | 20% |
From the original article
5 min read at cyberscoop.com
Attacker interest in the vulnerability is magnified by an unparalleled number of publicly available exploits, earning the defect the highest verified public exploit count of any CVE ever.
By @CyberScoopNews · cyberscoop.com
A short excerpt; the article and its images belong to the publisher. Summary, key facts and assessment above are AI-written from the article and can be wrong.