CVE-2025-55182 — React2Shell

🔴 CVSS 10.0. Unauthenticated RCE in React Server Components.

One crafted HTTP request to a Server Function endpoint → code execution on the server. No login. Default configs. Actively exploited in the wild.

If you’re running React 19 RSC / Next.js App Router and haven’t patched — do that first.

🗃 Affected packages: react-server-dom-webpack, -parcel, -turbopack (19.0 / 19.1.0–19.1.1 / 19.2.0).

Reading the advisory isn’t enough though.

Want to actually understand the attack path - enum the surface, craft the payload, get a shell, and see why this class of bug is
so dangerous?

Practice it on KickStore, an Easy Linux machine on MahadSec built around this vulnerability class.

🛡 https://my.mahadsec.com/standalone-labs/machine/kickstore

📁 Patch your apps. Then break the lab version so you recognize it next time it shows up in a real engagement.