# React2Shell CVE-2025-55182 — Multiple Threat Actors Actively Exploiting React Server Components RCE (CVSS 10.0)

> CVE-2025-55182 ('React2Shell') is a CVSS 10.0 unauthenticated remote code execution vulnerability in React Server Components (RSC) affecting packages react-server-dom-webpack, react-server-dom-parcel, and react-server-dom-turbopack versions 19.0, 19.1.0, 19.1.1, and 19.2.0. A single HTTP request executes arbitrary code with the web server process privileges. Within 48 hours of disclosure (Dec 3, 2025), multiple threat actors began exploitation — including China-nexus espionage groups UNC5174/UNC6600/UNC6586/UNC6588/UNC6595/UNC6603, Iran-nexus actors, and financially motivated cryptomining operators. JPCERT/CC documented a single server compromised by MULTIPLE threat actors simultaneously within 2 days: coin miners (XMRig), HISONIC backdoor (UNC6603), SNOWLIGHT downloader + CrossC2 RAT, Global Socket (gsocket) backdoor, and website defacement — all on the same server. Google Threat Intelligence Group (GTIG) identified 5 distinct malware families deployed post-exploitation: MINOCAT tunneler, SNOWLIGHT/VSHELL downloader, COMPOOD backdoor, HISONIC backdoor, and ANGRYREBEL.LINUX. 100+ scanning IPs observed targeting a single server in 3 days. React/Next.js are among the most widely deployed web frameworks globally — the vulnerable RSC packages are dependencies in millions of applications. Three additional CVEs followed (CVE-2025-55183, CVE-2025-55184, CVE-2025-67779). Fixed in RSC 19.0.1, 19.1.2, 19.2.1+ (RCE), 19.2.2 (info disclosure), 19.2.3 (DoS).

- **Published:** 2026-02-13T02:04:00Z
- **Last reviewed:** 2026-10-17T21:31:15.085Z
- **Canonical:** https://intel.threadlinqs.com/threat/TL-2026-0080
- **ID:** TL-2026-0080
- **Severity:** CRITICAL (CVSS 10)
- **Category:** VULNERABILITY
- **Status:** ACTIVE
- **Actor:** Earth Lamia (China, Iran)
- **Detections:** 12 · **IOCs:** 122 (full data via the Threadlinqs MCP server — Purple tier)
- **CVEs:** CVE-2025-55182, CVE-2025-55183, CVE-2025-55184, CVE-2025-67779, CVE-2025-66478

## Description

**Vulnerability Details:**
CVE-2025-55182 is an unauthenticated remote code execution (RCE) vulnerability in React Server Components (RSC). The flaw allows an unauthenticated attacker to send a SINGLE HTTP request that executes arbitrary code with the privileges of the user running the affected web server process. CVSS v3.x score: 10.0 (maximum). CVSS v4: 9.3. The vulnerability exists in RSC packages used by popular frameworks like Next.js, making the exposed attack surface enormous.

Vulnerable packages: react-server-dom-webpack, react-server-dom-parcel, react-server-dom-turbopack (versions 19.0, 19.1.0, 19.1.1, 19.2.0). The mere presence of vulnerable packages on systems is often enough to permit exploitation — multiple valid payload formats and techniques exist. A separate CVE for Next.js (CVE-2025-66478) was issued but marked as a duplicate of CVE-2025-55182.

**Attack Timeline (JPCERT/CC documented case):**
- Dec 3, 2025: CVE-2025-55182 disclosed
- Dec 5, 15:52 JST: First coin miner (sex.sh, xmrig) installed — 48 hours after disclosure
- Dec 6, 07:28: Second coin miner wave
- Dec 6, 09:53-11:00: HISONIC backdoor (javax) installed — attributed to UNC6603
- Dec 6, 15:00: Global Socket (gsocket as npm-cli) installed with hourly cron — backdoor over port 53 (DNS)
- Dec 6, 19:31: SNOWLIGHT downloader (javas) + CrossC2 RAT (rsyslo) installed — attributed to UNC5174
- Dec 7, 12:24: Third coin miner wave
- Dec 7, 16:51: Cron modified — /tmp/kernal (disguised as kernel) executing every minute
- Dec 7, 19:46: Website defacement with CVE warning in 4 languages
- Dec 7, 22:15: Incident discovered via user report
- Dec 5-7: 100+ unique scanning IPs observed targeting the server

**Threat Actor Attribution (GTIG/Mandiant):**
1. **UNC6600** (China-nexus espionage): Deployed MINOCAT tunneler. Creates hidden .systemd-utils directory, establishes persistence via cron + systemd + .bashrc injection. MINOCAT is 64-bit ELF with embedded Fast Reverse Proxy (FRP) client.
2. **UNC6586** (China-nexus, suspected): Deployed SNOWLIGHT downloader fetching from reactcdn.windowserrorapis[.]com. SNOWLIGHT is VSHELL component — Go-based multi-platform backdoor.
3. **UNC6588** (China-nexus): Deployed COMPOOD backdoor masquerading as /tmp/vim, then executing as polkitd. Historically linked to China-nexus espionage.
4. **UNC6603** (China-nexus): Deployed updated HISONIC backdoor — Go-based implant using Cloudflare Pages and GitLab for encrypted config retrieval. Targeting AWS and Alibaba Cloud in APAC.
5. **UNC6595** (China-nexus): Deployed ANGRYREBEL.LINUX masquerading as sshd in /etc/. Uses timestomping and shell history clearing for anti-forensics.
6. **UNC5174** (China-nexus, MSS-affiliated): Previously known for SNOWLIGHT. IIJ documented Windows variant in Oct 2025 targeting Japanese organizations.
7. **Financially motivated actors**: XMRig cryptomining, the FIRST to exploit (within 48 hours).
8. **Iran-nexus actors**: GTIG observed exploitation but details not published.
9. **Website defacers**: Warning messages in 4 languages urging patching.

**Additional Context:**
AWS reported that China-nexus groups Earth Lamia (tracked as UNC5454 by GTIG) and Jackpot Panda are also exploiting CVE-2025-55182. Underground forums are actively sharing scanning tools, PoC code, and exploitation experiences. Many non-functional and malicious fake PoCs were distributed, some containing malware targeting security researchers. Three additional CVEs followed: CVE-2025-55183 (info disclosure), CVE-2025-55184 (DoS), CVE-2025-67779 (DoS, incomplete patch for 55184).

## MITRE ATT&CK

- T1190 Exploit Public-Facing Application
- T1059 Command and Scripting Interpreter
- T1053 Scheduled Task/Job
- T1543 Create or Modify System Process
- T1546 Event Triggered Execution
- T1505 Server Software Component
- T1036 Masquerading
- T1070 Indicator Removal
- T1564 Hide Artifacts
- T1027 Obfuscated Files or Information
- T1071 Application Layer Protocol
- T1090 Proxy
- T1105 Ingress Tool Transfer
- T1573 Encrypted Channel
- T1571 Non-Standard Port
- T1572 Protocol Tunneling
- T1082 System Information Discovery
- T1005 Data from Local System
- T1041 Exfiltration Over C2 Channel
- T1496 Resource Hijacking
- T1491 Defacement
- T1583 Acquire Infrastructure
- T1587 Develop Capabilities
- T1588 Obtain Capabilities
- T1203 Exploitation for Client Execution
- T1552 Unsecured Credentials
- T1046 Network Service Discovery
- T1580 Cloud Infrastructure Discovery
- T1210 Exploitation of Remote Services
- T1530 Data from Cloud Storage
- T1567 Exfiltration Over Web Service
- T1565 Data Manipulation
- T1595 Active Scanning
- T1569 System Services
- T1547 Boot or Logon Autostart Execution
- T1098 Account Manipulation
- T1140 Deobfuscate/Decode Files or Information
- T1685 Disable or Modify Tools
- T1222 File and Directory Permissions Modification
- T1518 Software Discovery

## Sources

- [JPCERT/CC — Multiple Threat Actors Rapidly Exploit React2Shell: A Case Study of Active Compromise](https://blogs.jpcert.or.jp/en/2026/02/multiple-threat-actors-rapidly-exploit-react2shell-a-case-study-of-active-compromise.html)
- [Google Threat Intelligence Group — Multiple Threat Actors Exploit React2Shell (CVE-2025-55182)](https://cloud.google.com/blog/topics/threat-intelligence/threat-actors-exploit-react2shell-cve-2025-55182)
- [React Official Security Advisory — Critical Security Vulnerability in React Server Components](https://react.dev/blog/2025/12/03/critical-security-vulnerability-in-react-server-components)
- [React DoS and Source Code Exposure Vulnerabilities (CVE-2025-55183, CVE-2025-55184, CVE-2025-67779)](https://react.dev/blog/2025/12/11/denial-of-service-and-source-code-exposure-in-react-server-components)
- [Wiz — NextJS CVE-2025-55182 React2Shell Deep Dive](https://www.wiz.io/blog/nextjs-cve-2025-55182-react2shell-deep-dive)
- [IIJ Security — UNC5174 Windows SNOWLIGHT Malware Analysis](https://sect.iij.ad.jp/blog/2025/11/unc5174-windows-snowlight-in-2025/)
- [AWS Security Blog — China-Nexus Groups Exploit React2Shell CVE-2025-55182](https://aws.amazon.com/blogs/security/china-nexus-cyber-threat-groups-rapidly-exploit-react2shell-vulnerability-cve-2025-55182/)
- [Huntress — PeerBlight Linux Backdoor Exploits React2Shell](https://www.huntress.com/blog/peerblight-linux-backdoor-exploits-react2shell)
- [JPCERT/CC — CrossC2 Expanding Cobalt Strike Beacon to Cross-Platform Attacks](https://blogs.jpcert.or.jp/en/2025/08/crossc2.html)
- [VulnCheck — CVE-2025-55182 In-Memory Next.js Web Shell PoC](https://github.com/vulncheck-oss/cve-2025-55182)
- [Google Threat Intelligence IOC Collection for React2Shell](https://www.virustotal.com/gui/collection/f87025efaf8d9197f69338460fa92d5e98f2fcb2500ed7fd2fb8a6bb8980d9d7/summary)
- [Google Cloud Armor WAF Rule for CVE-2025-55182](https://docs.google.com/armor/docs/waf-rules#cves_and_other_vulnerabilities)

## Full data

Detection queries (Splunk SPL / Microsoft KQL / Sigma) and IOC values require the Threadlinqs MCP server (Purple tier): https://intel.threadlinqs.com/mcp

Canonical: https://intel.threadlinqs.com/threat/TL-2026-0080