-
React2Shell (CVE-2025-55182) Exploitation Attempt
Sep 19, 2026 · Domain: Network Domain: Application Domain: Web Use Case: Threat Detection Use Case: Vulnerability Tactic: Initial Access Tactic: Execution Data Source: Network Packet Capture Resources: Investigation Guide Noise: Low Performance: Fast Profile: Recommended Threat: Vulnerability Exploit Rule Type: Event Correlation (EQL) Vuln: CVE-2025-55182 Threat: React2Shell ·This rule detects exploitation attempts targeting CVE-2025-55182, a critical remote code execution vulnerability in React Server Components (RSC) Flight protocol. The vulnerability allows attackers to execute arbitrary code on the server by sending specially crafted deserialization payloads that exploit prototype chain traversal to access the Function constructor. This rule focuses on high-fidelity indicators of active exploitation including successful command execution responses and prototype pollution attack patterns.
Read More -
React2Shell Network Security Alert
Sep 19, 2026 · Domain: Network Domain: Application Domain: Web Use Case: Threat Detection Use Case: Vulnerability Tactic: Initial Access Tactic: Execution Data Source: PAN-OS Data Source: Fortinet Data Source: Suricata Data Source: Cisco FTD Resources: Investigation Guide Noise: Medium Performance: Normal Profile: Recommended Threat: Vulnerability Exploit Rule Type: Custom Query (KQL) Vuln: CVE-2025-55182 Threat: React2Shell ·This rule identifies network security alerts related to CVE-2025-55182 exploitation attempts from different network security integrations. CVE-2025-55182 is a critical remote code execution vulnerability in React Server Components (RSC) Flight protocol. The vulnerability allows attackers to execute arbitrary code on the server by sending specially crafted deserialization payloads that exploit prototype chain traversal to access the Function constructor.
Read More -
Suspicious React Server Child Process
Sep 19, 2026 · Domain: Endpoint OS: Linux OS: macOS OS: Windows Use Case: Threat Detection Tactic: Initial Access Data Source: Elastic Defend Data Source: Auditd Manager Data Source: SentinelOne Data Source: Sysmon Resources: Investigation Guide Noise: Medium Performance: Normal Profile: Recommended Threat: Vulnerability Exploit Rule Type: Event Correlation (EQL) Platform: Windows Platform: Linux Platform: macOS Vuln: CVE-2025-55182 Vuln: CVE-2025-66478 Threat: React2Shell ·This rule detects suspicious child process activity from a React server application. This could be related to successful exploitation of CVE-2025-55182 or CVE-2025-66478. These vulnerabilities allow attackers to execute remote code due to insecure deserialization of React Server Components (RSC) Flight payloads, leading to unauthenticated RCE on servers running React 19.x or Next.js 14.3.0-canary+, 15.x, and 16.x with the App Router enabled
Read More