React server components bring a lot of power to web development, but sometimes power comes with risk When exploited, an attacker can execute arbitrary code on the server without authentication A maximum severity vulnerability, dubbed 'react2shell', in the react server components (rsc) 'flight' protocol allows remote code execution without authentication in react and next.js applications.
It affects how react decodes payloads sent to react server function (server action) endpoints via the react flight protocol The vulnerability arises during deserialization of these flight payloads. The react team describes it as a flaw that allows:
The vulnerability exists in how react server function/packages process the react server components (rscs) payloads via the “flight” protocol
