CVE-2025-55182: React2Shell Analysis, Proof-of-Concept Chaos, and In-the-Wild Exploitation

This report analyzes CVE-2025-55182 (React2Shell), a critical pre-authentication RCE in React Server Components' Flight deserialization that enables attackers to reach the Function constructor and execute arbitrary Node.js commands; it documents exploitation chains, observed campaigns delivering Mirai, Cobalt Strike, Sliver, and other payloads, provides IoCs, mitigation guidance, and patched versions for React/Next.js.