React2Shell Impacting Dify and AI Platforms (CVE-2025-55182)
Date: 2025-12
Affected: React2Shell Impacting Dify and AI Platforms (CVE-2025-55182)
Attack vector: rce
Category: real-world
Severity: Critical
CVE: CVE-2025-55182

CVSS 10.0. Critical unauthenticated RCE in React Server Components' Flight protocol. A single HTTP request executes arbitrary code. Affected React 19.x used by Dify and other AI platforms. Multiple threat actors exploited within days.


Mitigations:

Architectural layers (MAESTRO):