React2Shell CVE-2025-55182 — Multiple Threat Actors Actively Exploiting React Server Components RCE (CVSS 10.0)
React2Shell CVE-2025-55182 (TL-2026-0080) is a critical-severity software vulnerability scored CVSS 10, first published 2026-02-13 and last reviewed 2026-07-19. It is attributed to Earth Lamia (China, Iran) with high confidence, references 5 CVEs (CVE-2025-55182, CVE-2025-55183, CVE-2025-55184), maps to 46 MITRE ATT&CK techniques (T1005, T1008, T1021), and is covered by 12 detection rules and 115 indicators of compromise.
Key facts for TL-2026-0080
- Threat ID
- TL-2026-0080
- Severity
- CRITICAL
- CVSS
- 10
- Status
- ACTIVE
- Category
- VULNERABILITY
- First published
- 2026-02-13
- Last reviewed
- 2026-07-19
- Attribution
- Earth Lamia
- Attribution confidence
- HIGH
- Nation-state nexus
- China, Iran
- Motivation
- ESPIONAGE
- Target sectors
- Technology, Government, Cloud Infrastructure, Education, Financial Services, Healthcare, Critical Infrastructure
- Target regions
- Global, Asia Pacific, Japan, North America, Europe
- Detection rules
- 12
- Indicators of compromise
- 115
- Updates
- 2026-07-19 · 2 updates · revalidated 2× · latest source
Malware and tooling in React2Shell CVE-2025-55182
Malware and tooling: react-server-dom-webpack and react-server-dom-parcel — vulnerable RSC serialization packages. All versions prior to patched release are affected when processing untrusted RSC payloads
CVE-2025-55182 ('React2Shell') is a CVSS 10.0 unauthenticated remote code execution vulnerability in React Server Components (RSC) affecting packages react-server-dom-webpack, react-server-dom-parcel, and react-server-dom-turbopack versions 19.0, 19.1.0, 19.1.1, and 19.2.0. A single HTTP request executes arbitrary code with the web server process privileges. Within 48 hours of disclosure (Dec 3, 2025), multiple threat actors began exploitation — including China-nexus espionage groups UNC5174/UNC6600/UNC6586/UNC6588/UNC6595/UNC6603, Iran-nexus actors, and financially motivated cryptomining operators. JPCERT/CC documented a single server compromised by MULTIPLE threat actors simultaneously within 2 days: coin miners (XMRig), HISONIC backdoor (UNC6603), SNOWLIGHT downloader + CrossC2 RAT, Global Socket (gsocket) backdoor, and website defacement — all on the same server. Google Threat Intelligence Group (GTIG) identified 5 distinct malware families deployed post-exploitation: MINOCAT tunneler, SNOWLIGHT/VSHELL downloader, COMPOOD backdoor, HISONIC backdoor, and ANGRYREBEL.LINUX. 100+ scanning IPs observed targeting a single server in 3 days. React/Next.js are among the most widely deployed web frameworks globally — the vulnerable RSC packages are dependencies in millions of applications. Three additional CVEs followed (CVE-2025-55183, CVE-2025-55184, CVE-2025-67779). Fixed in RSC 19.0.1, 19.1.2, 19.2.1+ (RCE), 19.2.2 (info disclosure), 19.2.3 (DoS).
How React2Shell CVE-2025-55182 works
**Vulnerability Details:** CVE-2025-55182 is an unauthenticated remote code execution (RCE) vulnerability in React Server Components (RSC). The flaw allows an unauthenticated attacker to send a SINGLE HTTP request that executes arbitrary code with the privileges of the user running the affected web server process. CVSS v3.x score: 10.0 (maximum). CVSS v4: 9.3. The vulnerability exists in RSC packages used by popular frameworks like Next.js, making the exposed attack surface enormous.
Vulnerable packages: react-server-dom-webpack, react-server-dom-parcel, react-server-dom-turbopack (versions 19.0, 19.1.0, 19.1.1, 19.2.0). The mere presence of vulnerable packages on systems is often enough to permit exploitation — multiple valid payload formats and techniques exist. A separate CVE for Next.js (CVE-2025-66478) was issued but marked as a duplicate of CVE-2025-55182.
**Attack Timeline (JPCERT/CC documented case):** - Dec 3, 2025: CVE-2025-55182 disclosed - Dec 5, 15:52 JST: First coin miner (sex.sh, xmrig) installed — 48 hours after disclosure - Dec 6, 07:28: Second coin miner wave - Dec 6, 09:53-11:00: HISONIC backdoor (javax) installed — attributed to UNC6603 - Dec 6, 15:00: Global Socket (gsocket as npm-cli) installed with hourly cron — backdoor over port 53 (DNS) - Dec 6, 19:31: SNOWLIGHT downloader (javas) + CrossC2 RAT (rsyslo) installed — attributed to UNC5174 - Dec 7, 12:24: Third coin miner wave - Dec 7, 16:51: Cron modified — /tmp/kernal (disguised as kernel) executing every minute - Dec 7, 19:46: Website defacement with CVE warning in 4 languages - Dec 7, 22:15: Incident discovered via user report - Dec 5-7: 100+ unique scanning IPs observed targeting the server
**Threat Actor Attribution (GTIG/Mandiant):** 1. **UNC6600** (China-nexus espionage): Deployed MINOCAT tunneler. Creates hidden .systemd-utils directory, establishes persistence via cron + systemd + .bashrc injection. MINOCAT is 64-bit ELF with embedded Fast Reverse Proxy (FRP) client. 2. **UNC6586** (China-nexus, suspected): Deployed SNOWLIGHT downloader fetching from reactcdn.windowserrorapis[.]com. SNOWLIGHT is VSHELL component — Go-based multi-platform backdoor. 3. **UNC6588** (China-nexus): Deployed COMPOOD backdoor masquerading as /tmp/vim, then executing as polkitd. Historically linked to China-nexus espionage. 4. **UNC6603** (China-nexus): Deployed updated HISONIC backdoor — Go-based implant using Cloudflare Pages and GitLab for encrypted config retrieval. Targeting AWS and Alibaba Cloud in APAC. 5. **UNC6595** (China-nexus): Deployed ANGRYREBEL.LINUX masquerading as sshd in /etc/. Uses timestomping and shell history clearing for anti-forensics. 6. **UNC5174** (China-nexus, MSS-affiliated): Previously known for SNOWLIGHT. IIJ documented Windows variant in Oct 2025 targeting Japanese organizations. 7. **Financially motivated actors**: XMRig cryptomining, the FIRST to exploit (within 48 hours). 8. **Iran-nexus actors**: GTIG observed exploitation but details not published. 9. **Website defacers**: Warning messages in 4 languages urging patching.
**Additional Context:** AWS reported that China-nexus groups Earth Lamia (tracked as UNC5454 by GTIG) and Jackpot Panda are also exploiting CVE-2025-55182. Underground forums are actively sharing scanning tools, PoC code, and exploitation experiences. Many non-functional and malicious fake PoCs were distributed, some containing malware targeting security researchers. Three additional CVEs followed: CVE-2025-55183 (info disclosure), CVE-2025-55184 (DoS), CVE-2025-67779 (DoS, incomplete patch for 55184).
MITRE ATT&CK techniques used in TL-2026-0080
collection
T1005 Data from Local System; T1530 Data from Cloud Storage
Command and Control
T1008 Fallback Channels; T1102 Web Service
Lateral Movement
defense-evasion
T1027 Obfuscated Files or Information; T1036 Masquerading; T1070 Indicator Removal; T1564 Hide Artifacts
exfiltration
T1041 Exfiltration Over C2 Channel; T1567 Exfiltration Over Web Service
discovery
T1046 Network Service Discovery; T1082 System Information Discovery; T1580 Cloud Infrastructure Discovery
execution
T1053 Scheduled Task/Job; T1059 Command and Scripting Interpreter; T1203 Exploitation for Client Execution
command-and-control
T1071 Application Layer Protocol; T1090 Proxy; T1105 Ingress Tool Transfer; T1571 Non-Standard Port; T1572 Protocol Tunneling; T1573 Encrypted Channel
Persistence
T1098 Account Manipulation; T1547 Boot or Logon Autostart Execution
Defense Evasion
T1140 Deobfuscate/Decode Files or Information
initial-access
T1190 Exploit Public-Facing Application
lateral-movement
T1210 Exploitation of Remote Services
defense-impairment
T1222 File and Directory Permissions Modification; T1685 Disable or Modify Tools
impact
T1491 Defacement; T1496 Resource Hijacking; T1565 Data Manipulation
Impact
T1498 Network Denial of Service; T1499 Endpoint Denial of Service
persistence
T1505 Server Software Component; T1543 Create or Modify System Process
Discovery
T1518 Software Discovery; T1614 System Location Discovery
privilege-escalation
T1546 Event Triggered Execution
credential-access
Execution
resource-development
T1583 Acquire Infrastructure; T1587 Develop Capabilities; T1588 Obtain Capabilities
Reconnaissance
Remediation for React2Shell CVE-2025-55182
Patches
- RSC 19.0.1, 19.1.2, 19.2.1: Fix CVE-2025-55182 (RCE)
- RSC 19.2.2: Fix CVE-2025-55183 (info disclosure)
- RSC 19.2.3: Fix CVE-2025-55184 and CVE-2025-67779 (DoS) — RECOMMENDED version
Immediate actions
- PATCH IMMEDIATELY: Upgrade react-server-dom-webpack/parcel/turbopack to 19.2.3 (addresses RCE + info disclosure + DoS)
- Deploy WAF rules to detect and block React2Shell exploitation attempts — Google Cloud Armor rule available
- Hunt for compromise indicators: hidden directories ($HOME/.systemd-utils), unauthorized cron jobs, processes named ntpclient/kernal/javax/rsyslo/npm-cli
- Check web server access logs for suspicious HTTP POST requests from Dec 5, 2025 onward — 100+ scanning IPs documented
Workarounds
- WAF rules blocking RSC exploitation payloads as temporary mitigation while patching
- Network segmentation to limit web server lateral movement capability
- Disable React Server Components if not required until patching is complete
Longer-term hardening
- Audit all dependencies for vulnerable RSC packages — the mere presence of vulnerable packages permits exploitation
- Implement runtime application security monitoring (RASP) for React/Next.js applications
- Monitor for unauthorized process execution from web server user context (cron jobs, shell scripts, ELF binaries)
- Deploy network monitoring for C2 indicators: reactcdn.windowserrorapis[.]com, ports 53/443/59999
- Verify patches address ALL CVEs: 19.2.3 for complete coverage (RCE + info disclosure + DoS)
CVEs associated with React2Shell CVE-2025-55182
CVE-2025-55182, CVE-2025-55183, CVE-2025-55184, CVE-2025-67779, CVE-2025-66478
Weaknesses (CWE) in React2Shell CVE-2025-55182
CWE-94, CWE-502, CWE-20, CWE-749, CWE-400
Timeline of React2Shell CVE-2025-55182
Showing the 20 most recent tracked events.
- 100+ unique IP addresses observed scanning for React2Shell vulnerability against a single server over Dec 5-7. Exploitation attempts identified via HTTP POST patterns in web server access logs. Source: JPCERT/CC
- First exploitation observed — coin miners (sex.sh, XMRig) installed on compromised server within 48 HOURS of disclosure. JPCERT/CC documents the rapid weaponization timeline. Source: JPCERT/CC
- SNOWLIGHT downloader (javas) and CrossC2 RAT (rsyslo — Linux Cobalt Strike implementation) installed on same server. C2: 45.143.131[.]123:59999 (SNOWLIGHT) and 154.89.152[.]240:443 (CrossC2). Attributed to UNC5174. Source: JPCERT/CC
- Global Socket (gsocket) tool deployed as npm-cli with hourly cron — backdoor communicating over port 53 (DNS) using pre-shared key encryption and Global Socket Relay Network (GSRN). Source: JPCERT/CC
- UNC6603 deploys HISONIC Go-based backdoor (javax) — uses Cloudflare Pages and GitLab for encrypted config retrieval. Targeting AWS and Alibaba Cloud in APAC. Source: GTIG/Mandiant + JPCERT/CC
- Shadowserver Foundation reports 28,964 internet-facing IP addresses still vulnerable to React2Shell.
- Incident discovered at 22:15 JST after service user reported website defacement. Investigation revealed multiple concurrent compromises by different threat actors on same server. Source: JPCERT/CC
- Website defaced with CVE-2025-55182 warning in 4 languages urging immediate patching. Multiple websites defaced globally (Japan and overseas) with identical messages. Source: JPCERT/CC
- Huntress publishes PeerBlight/CowTunnel/ZinFoq/Sliver Linux-backdoor analysis; Sysdig publishes EtherRAT DPRK-nexus analysis, both tied to React2Shell exploitation.
- VulnCheck publishes in-memory Next.js web shell deployment PoC for CVE-2025-55182. Exploit capabilities continue to expand beyond initial disclosure. Source: https://github.com/vulncheck-oss/cve-2025-55182
- DPRK-affiliated cluster UNC5342 identified using blockchain-based EtherHiding payload delivery; KSwapDoor (initially misidentified as BPFDoor) and the PAM-masquerading Auto-color Linux implant discovered riding the React2Shell exploit chain.
- Censys identifies over 2.1 million exposed services running Next.js/RSC-based frameworks amid active internet-wide scanning; Unit 42 separately estimates ~968,000 reachable React/Next.js instances.
- GTIG observes UNC6600 deploying MINOCAT tunneler (64-bit ELF with embedded FRP client) via React2Shell. Persistence via cron + systemd + .bashrc injection. Source: GTIG/Mandiant
- Three additional React CVEs disclosed: CVE-2025-55183 (info disclosure), CVE-2025-55184 (DoS), CVE-2025-67779 (DoS — incomplete patch for 55184). Post-disclosure scrutiny revealing additional vulnerabilities. Source: React official
- Microsoft Security publishes defensive guidance for CVE-2025-55182 (React2Shell) in React Server Components.
- BI.ZONE publishes 'Adversaries Exploit CVE-2025-55182 to Attack Russian Companies,' detailing a distinct Dec 2025 campaign against Russian insurance/e-commerce/IT-sector orgs with full malware and persistence tooling (XMRig, Kaiji, RustoBot, Sliver, CrossC2/Cobalt Strike, Tactical RMM, VShell, EtherRAT, PeerBlight, CowTunnel, ZinFoq).
- AWS reports China-nexus groups Earth Lamia (UNC5454) and Jackpot Panda actively exploiting CVE-2025-55182. Confirms multi-group exploitation at scale. Source: AWS Security Blog
- GTIG reports active underground forum discussions sharing React2Shell scanning tools, PoC code, and exploitation experiences. Vulnerability now fully commoditized. Source: GTIG/Mandiant
- JPCERT/CC and Google GTIG publish detailed analysis — 5+ China-nexus groups, 5 distinct malware families, Iran-nexus actors, cryptomining, and website defacement. Most comprehensive React2Shell reporting to date. Source: JPCERT/CC + GTIG
- As of 2026-05-29, React2Shell (CVE-2025-55182) remains actively exploited: it is in CISA KEV (added 2025-12-05), patches exist but a large unpatched population persists (Censys 250k+ instances; Wiz 39% of cloud envs), and 8.1M+ attack sessions by Jan 2026. China/Iran-nexus actors (UNC5174, Earth Lamia) continue operating and it has escalated into a ransomware initial-access vector (Weaxor), with no takedown or successor.
Update history for TL-2026-0080
- 2026-07-19 — React2Shell — Critical Pre-Auth RCE in React Server Components Flight Protocol Deserialization (CVE-2025-55182 / CVE-2025-66478): What changed No field escalations — severity (CRITICAL), exploitability (ACTIVE), and status (ACTIVE) already matched the peak assessment on record. Scope of documented intrusion activity widened: an additional merged CVE (CVE-2025-66478) a
- 2026-07-18 — CVE-2025-55182 ("React2Shell") Insecure Deserialization in React Server Components Exploited Against Russian and Global Targets: What changed Exploitability escalated from unset to ACTIVE; precise CVSS 10.0 vector (AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H) added. A newly documented Dec 2025 BI.ZONE campaign shows the same CVE-2025-55182 vulnerability being exploited by an
Sources cited for React2Shell CVE-2025-55182
- JPCERT/CC — Multiple Threat Actors Rapidly Exploit React2Shell: A Case Study of Active Compromise
- Google Threat Intelligence Group — Multiple Threat Actors Exploit React2Shell (CVE-2025-55182)
- React Official Security Advisory — Critical Security Vulnerability in React Server Components
- React DoS and Source Code Exposure Vulnerabilities (CVE-2025-55183, CVE-2025-55184, CVE-2025-67779)
- Wiz — NextJS CVE-2025-55182 React2Shell Deep Dive
- IIJ Security — UNC5174 Windows SNOWLIGHT Malware Analysis
- AWS Security Blog — China-Nexus Groups Exploit React2Shell CVE-2025-55182
- Huntress — PeerBlight Linux Backdoor Exploits React2Shell
- JPCERT/CC — CrossC2 Expanding Cobalt Strike Beacon to Cross-Platform Attacks
- VulnCheck — CVE-2025-55182 In-Memory Next.js Web Shell PoC
- Google Threat Intelligence IOC Collection for React2Shell
- Google Cloud Armor WAF Rule for CVE-2025-55182
More in vulnerability
- CVE-2025-59201: Windows Network Connection Status Indicator (NCSI) Elevation of Privilege via Registry Symbolic Link Abuse
- CVE-2026-20817: Windows Error Reporting Service (WerSvc.dll) Local Privilege Escalation via ALPC Argument Injection
- Sudo iptables NOPASSWD Misconfiguration Enables Local Privilege Escalation via Comment Injection
- CVE-2025-37947: Out-of-Bounds Write in Linux ksmbd Kernel SMB Server Enables Local Privilege Escalation
- Dell ObjectScale Critical Deserialization Flaw (CVE-2026-70416, CVSS 10.0) Enables Unauthenticated RCE
Detection coverage for TL-2026-0080
As of 2026-07-19, Threadlinqs Intelligence publishes 12 detection rule(s) for TL-2026-0080 across Splunk SPL, Microsoft KQL and Sigma, covering 115 indicator(s) of compromise. The whole corpus is readable without an account; a free account unlocks full detection query text in Splunk SPL, Microsoft KQL and Sigma; paid tiers add raw indicator values, correlation and the MCP server. Threadlinqs MCP server · View plans.