[News](/news) Critical React2Shell Flaw Added to CISA KEV After Confirmed Active Exploitation [Blog](/blog)[Breaches](/breaches)[Resources](/resources)[News](/news) # Critical React2Shell Flaw Added to CISA KEV After Confirmed Active Exploitation ##### [UpGuard Team](/team/upguard) December 9, 2025 ### Key Facts: Barts Health NHS Trust data breach and security incident overview | Date Reported | 2025-12-06 | | --------------- | ----------------------------------- | | Severity Level | Critical | | Organization | React (react.dev) | | Threat Actor | Earth Lamia, Jackpot Panda, UNC5174 | | Associated Tags | Advisory, RCE, React2Shell | Monitor for Future Attacks from Groups Like Earth Lamia, Jackpot Panda, and UNC5174. [*Start continuous monitoring with UpGuard.*](https://www.upguard.com/product/breach-risk/threat-monitoring) ## What happened in the React security Incident? On December 6, 2025, the Cybersecurity and Infrastructure Security Agency (CISA) added a critical vulnerability affecting React to its Known Exploited Vulnerabilities (KEV) catalog following confirmed reports of active exploitation. The incident involves a Remote Code Execution (RCE) flaw widely referred to as "React2Shell" ([CVE-2025-55182](https://nvd.nist.gov/vuln/detail/CVE-2025-55182)), which has attracted the attention of multiple threat groups including Earth Lamia, Jackpot Panda, and UNC5174. The vulnerability, assigned a CVSS score of 10.0, stems from insecure deserialization in the "Flight" protocol used by React Server Components. This flaw allows unauthenticated attackers to execute arbitrary commands on servers via specially crafted HTTP requests. Amazon reported identifying attacks linked to Chinese state-nexus groups within hours of the flaw's disclosure, and Palo Alto Networks Unit 42 has confirmed that over 30 organizations have already been affected. Due to the critical nature of the flaw, unpatched systems face immediate risks of full server compromise. ## Who is behind the incident? The exploitation of the React2Shell vulnerability has been linked to multiple China-nexus threat actors, including Earth Lamia, Jackpot Panda, and UNC5174. Earth Lamia is a known APT group that typically targets government, financial, and logistics sectors in Southeast Asia and Latin America, often employing custom loaders and SQL injection techniques. Jackpot Panda is similarly aligned with Chinese state interests, with a history of targeting online gambling operations and entities in East Asia. UNC5174, often acting as an initial access broker, is believed to be a contractor for China’s Ministry of State Security (MSS) and has been observed patching vulnerabilities after gaining access to lock out rival attackers. ## Related data breaches and security incidents * [Earth Lamia Targeting Southeast Asian Logistics (2025)](https://www.upguard.com/breaches) * [Jackpot Panda Gambling Sector Espionage (2024)](https://www.upguard.com/breaches) * [Critical RCE Vulnerabilities in 2025](https://www.upguard.com/breaches) ## Impact and risks for React users For organizations utilizing React Server Components or Next.js, this critical RCE vulnerability presents severe operational and security risks. If successfully exploited, the flaw grants attackers the ability to execute code remotely without authentication, which could lead to complete server takeover, data exfiltration, or the deployment of persistent malware such as cryptominers or backdoors. In similar critical RCE incidents, attackers have utilized initial access to move laterally across networks, leading to widespread data theft or ransomware deployment. To mitigate these risks, organizations must immediately update to patched versions (React 19.0.1, 19.1.2, 19.2.1) and audit their environments for signs of compromise. Continued transparency and rapid remediation are essential to preventing downstream impact on customer data. ## How to protect against similar security incidents * **Maintain timely patching and vulnerability management:** Ensure all internet-facing systems, particularly those using React and Next.js, are updated to the latest patched versions (e.g., React 19.0.1+) immediately to close the CVE-2025-55182 gap. * **Apply least-privilege access:** Restrict permissions for server-side processes and review stale accounts or keys regularly to limit the potential impact if a server is compromised. * **Set up dark web and data leak monitoring:** Implement continuous monitoring to detect early warning signs of exposure or discussions regarding your organization on underground forums. Secure your attack surface before the next incident. [*Start monitoring your attack surface with UpGuard.*](https://www.upguard.com/product/breach-risk/attack-surface-management) ## Frequently Asked Questions ### What happened in the React security breach? On December 6, 2025, CISA and security vendors disclosed a critical security breach involving React Server Components. According to initial reports, the "React2Shell" vulnerability allows unauthenticated remote code execution. ### When did the React breach occur? The React vulnerability was publicly reported and added to the CISA KEV catalog on December 6, 2025. Active exploitation by groups like Earth Lamia was observed shortly before and after this date. ### What data was exposed in the React incident? The specific types of data exposed in this incident depend on the individual server targeted. However, because the vulnerability allows for Remote Code Execution (RCE), attackers could potentially access any data stored on or accessible by the compromised server. ### Is my personal information at risk? If you interacted with a service using the vulnerable React components, there is a possibility your personal information could be affected. While full details of specific exposed data vary by organization, similar RCE incidents often result in the compromise of user databases, credentials, and financial records. ### How can I protect myself after a data breach? Take these steps immediately after learning of a breach: * Change passwords on any affected accounts and avoid reusing them elsewhere. * Turn on multi-factor authentication (MFA) for added security. * Monitor your financial statements and credit activity closely. * Be cautious of phishing attempts that may reference the breach. * Use breach monitoring tools to detect if your data appears on the dark web. ### What steps should companies take after being breached? Companies affected by breaches should prioritize containment and communication: * Secure compromised systems and investigate the scope of the incident. * Inform impacted individuals and authorities promptly. * Provide guidance on protective actions, like password resets or monitoring services. * Review security measures and patch vulnerabilities to prevent recurrence. * Deploy an attack surface management tool to avoid repeat incidents. Get instant alerts when your data appears on the dark web. [*Start monitoring for data leaks now.*](https://www.upguard.com/product/breach-risk/threat-monitoring) ## How secure is React? React is an open-source JavaScript library for building user interfaces for web and native applications. It allows developers to create reusable UI components that can be combined to build complete applications, with support for both client-side and server-side rendering. * View our free preliminary report on React’s security posture * 13 risk factors, including email security, SSL, DNS health, open ports and common vulnerabilities [View React's score](/security-report/react) [View score](/security-report/react) [https://react.dev/](/security-report/react) ### Sign up for our newsletter UpGuard's monthly newsletter cuts through the noise and brings you what matters most: our breaking research, in-depth analysis of emerging threats, and actionable strategic insights. ## Latest news Stay up-to-date with the latest news in cybersecurity. [](/news/hugging-face-data-breach-2026-07-20) #### [Hugging Face data breach: key facts and what we know so far](/news/hugging-face-data-breach-2026-07-20) A data breach involving Hugging Face was reported in July 2026. See incident details, impact on customers, and recommended security measures. ##### [UpGuard Team](/team/upguard) July 20, 2026 [](/news/ey-data-breach-2026-07-19) #### [EY data breach: what happened and what's at risk](/news/ey-data-breach-2026-07-19) A data breach involving EY was reported in July 2026. See incident details, impact on customers, and recommended security measures. ##### [UpGuard Team](/team/upguard) July 15, 2026 [](/news/south-florida-injury-convenient-care-data-breach-2026-07-16) #### [South Florida Injury & Convenient Care data breach exposes names and Social Security numbers](/news/south-florida-injury-convenient-care-data-breach-2026-07-16) A data breach involving South Florida Injury & Convenient Care was reported in July 2026. See incident details, impact on customers, and security measures. ##### [UpGuard Team](/team/upguard) July 15, 2026 [](/news/park-west-psychology-data-breach-2026-07-16) #### [Park West Psychology data breach: what happened and what's at risk](/news/park-west-psychology-data-breach-2026-07-16) A data breach involving Park West Psychology was reported in July 2026. See incident details, impact on customers, and recommended security measures. ##### [UpGuard Team](/team/upguard) July 15, 2026 [](/news/fall-river-municipal-credit-union-data-breach-2026-07-16) #### [Fall River Municipal Credit Union data breach: what happened and what's at risk](/news/fall-river-municipal-credit-union-data-breach-2026-07-16) A data breach involving Fall River Municipal Credit Union was reported in July 2026. See incident details, impact on customers, and recommended security measures. ##### [](#) July 14, 2026 [](/news/npcil-data-breach-2026-07-16) #### [NPCIL data breach: World Leaks claims exposure of Kudankulam Nuclear Power Plant files](/news/npcil-data-breach-2026-07-16) A data breach involving NPCIL was reported in July 2026. See incident details, impact on customers, and recommended security measures. ##### [UpGuard Team](/team/upguard) July 14, 2026 [View all news](/news) ## Protect your organization Get in touch or book a free demo. [Contact sales](/demo) [Free demo](/demo) ##### Free instant security score ## How secure is your organization? Request a free cybersecurity report to discover key risks on your website, email, network, and brand. * Instant insights you can act on immediately * Hundreds of risk factors including email security, SSL, DNS health, open ports and common vulnerabilities [Free score](/instant-security-score)