React2Shell Exploitation Escalates into Large-Scale Global Attacks, Forcing Emergency Mitigation

The React2Shell vulnerability (CVE-2025-55182) affects the React Server Components (RSC) Flight protocol. The underlying cause is unsafe deserialization that allows attackers to inject malicious logic that the server executes in a privileged context. A single, specially crafted HTTP request is sufficient with no authentication requirement, user interaction, or elevated permissions needed. Once successful, attackers can execute arbitrary, privileged JavaScript on the affected server. Over 35,000 exploitation attempts were recorded on a single day (December 10, 2025), with attackers first probing systems by running commands like 'whoami' before dropping cryptocurrency miners or botnet malware.