Coverage › CVE-2025-55182

CVE-2025-55182 Unmapped

Meta React Server Components Remote Code Execution Vulnerability

Vendor / product: Meta — React Server Components
Description (CISA): Meta React Server Components contains a remote code execution vulnerability that could allow unauthenticated remote code execution by exploiting a flaw in how React decodes payloads sent to React Server Function endpoints. Please note CVE-2025-66478 has been rejected, but it is associated with CVE-2025- 55182.
Added to KEV: 2025-12-05 — after the latest CTID mapping snapshot (2025-07-28)
Due date: 2025-12-12
Required action: Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable.
Known ransomware use: Known
CWE: none recorded by CISA
CISA notes: Check for signs of potential compromise on all internet accessible REACT instances after applying mitigations. For more information, please see: https://react.dev/blog/2025/12/03/critical-security-vulnerability-in-react-server-components
https://github.com/vercel-labs/fix-react2shell-next?tab=readme-ov-file
https://nvd.nist.gov/vuln/detail/CVE-2025-55182
Elsewhere: cve.org · NVD · CISA KEV · JSON

ATT&CK techniques

No public source states how this vulnerability is exploited in ATT&CK terms.

The only authoritative CVE → ATT&CK mapping in the open — CTID's Mappings Explorer, pinned to a KEV snapshot of 2025-07-28 and ATT&CK 16.1 — does not include CVE-2025-55182. This entry was added to KEV on 2025-12-05, after that snapshot; of the 283 entries added since, 0 have a mapping. CISA's catalogue carries no technique field. kevmap does not infer techniques from the CWE — here is why — and does not guess.

This page will change state automatically if a mapping is published. What is shown above is everything CISA publishes about the entry.

Sigma rules tagged with this CVE

2 rules in SigmaHQ carry the tag cve.2025-55182. These are shown as detection content for the CVE itself. Their ATT&CK tags are deliberately not rendered here: a rule author's tag is not an authoritative statement of how the vulnerability is exploited, and this page does not show techniques for unmapped entries.

Windows Suspicious Child Process from Node.js - React2Shell highexperimental

Author: Swachchhanda Shrawan Poudel (Nextron Systems), Nasreddine Bencherchali · 2025-12-05 · logsource: product=windows category=process_creation · 271de298-cc0e-4842-acd8-079a0a99ea65

Detects suspicious child processes started by Node.js server processes on Windows, which may indicate exploitation of vulnerabilities like CVE-2025-55182 (React2Shell). Attackers can abuse the Node.js 'child_process' module to run system commands or scripts using methods such as spawn(), exec(), execFile(), fork(), or execSync(). If execSync() or exec() is used in the exploit, the command line often shows a shell (e.g., cmd.exe /d /s /c ...) running a suspicious command unless other shells are explicitly invoked. For other methods, the spawned process appears directly in the Image field unless a shell is explicitly used.

CVE tags: CVE-2025-55182

Linux Suspicious Child Process from Node.js - React2Shell highexperimental

Author: Swachchhanda Shrawan Poudel (Nextron Systems), Nasreddine Bencherchali · 2025-12-05 · logsource: product=linux category=process_creation · c70834fa-fb9d-4aa0-9e7d-45ceed36f3f7

Detects suspicious child processes spawned from Node.js server processes on Linux systems, potentially indicating remote code execution exploitation such as CVE-2025-55182 (React2Shell). This rule particularly looks for exploitation of vulnerability on Node.js Servers where attackers abuse Node.js child_process module to execute arbitrary system commands. When execSync() or exec() is used, the command line often includes a shell invocation followed by suspicious commands or scripts (e.g., /bin/sh -c <malicious-command>). For other methods, the Image field will show the spawned process directly.

CVE tags: CVE-2025-55182