A critical vulnerability tracked as CVE-2025-55182 (React2shell) has been discovered in React Server Components (RSC) that affects both React and Next.js applications. The flaw carries a maximum CVSS score of 10.0 and allows unauthenticated remote code execution by exploiting how React decodes payloads sent to React Server Components. This vulnerability poses a severe threat to applications using RSC technology and requires immediate attention from developers and security teams.