React2Shell Remote Code Execution

**Executive Summary:** React2Shell is a critical unauthenticated remote code execution (RCE) vulnerability in React Server Components and Flight-implementing frameworks (including Next.js) tracked as CVE-2025-55182/CVE-2025-66478; it is being actively exploited in the wild, has been added to CISA's KEV catalog, and has been observed leveraging infrastructure tied to China-nexus actors—organizations should urgently apply vendor patches, enforce WAF protections on RSC/Flight endpoints, and perform proactive threat hunting.