Back Scworld Maximum severity React vulnerability threatens extensive compromise
Thirty-nine percent of cloud environments were noted by Wiz to have instances of the JavaScript library React and React-based frameworks, such as .js, that are vulnerable to the maximum severity unauthenticated remote code execution flaw, tracked as CVE-2025-55182, which could be subjected to widespread exploitation soon, reports The Register .
Immediate remediation of the security weakness has been urged by both the React team and .js lead maintainer Vercel, which tracks the issue as CVE-2025-66478, as it could be easily harnessed in cyberattacks. Illicit HTTP requests made to Server Function endpoints could allow RCE on the server upon deserialization by React, said Vercel in an alert.
"CVE-2025-55182 represents a major risk to users of one of the world's most widely used web application frameworks. Exploitation requires few prerequisites [and] there should be no doubt that in-the-wild exploitation is imminent as soon as attackers begin analyzing now-public patches," said watchTowr founder and CEO Benjamin Harris.
The full story
This article is one source in a clustered incident — the cluster page carries the summary, timeline and every other outlet covering it.
