React Server Components flaw enables unauthenticated code execution
React disclosed CVE-2025-55182, a maximum-severity flaw allowing unauthenticated remote code execution through vulnerable Server Components payload handling. Affected React 19 server-dom packages could expose applications even without user-authored Server Functions; CISA later confirmed exploitation.
Why it matters: The vulnerable packages sit underneath popular web frameworks used for AI applications and administrative surfaces. Remote compromise could expose prompts, credentials, model access, customer data, source code, and deployment infrastructure.