React2Shell (CVE-2025-55182/CVE-2025-66478)

Important update: A note on invalid PoCs We have seen a rapid trend of "Proof of Concepts" spreading which are not genuine PoCs. Anything that requires the developer to have explicitly exposed dangerous functionality to the client is not a valid PoC. Common examples we've seen in supposed "PoCs" are vm#runInThisContext, child_process#exec, and fs#writeFile. This would only be exploitable if you ha

[t-wada]

React Server Components （つまり Next.js も）で発見された認証不要で遠隔コード実行が可能になる非常に深刻な脆弱性（CVSS 10.0 つまり最高スコア）に React2Shell という名前が付いてサイトができた