TLDR Tech / Dev
The React2Shell Story
A security researcher describes finding React2Shell, a critical remote code execution flaw in React's undocumented “Flight” protocol used by Server Components and Next.js. Over a week, he and a collaborator discovered that the protocol's handling of complex objects and JavaScript “thenables” could be abused to hijack React's internals and chain function calls into arbitrary code execution. He reported it to Meta on November 30, and Meta confirmed it within roughly 17 hours and released a fix and advisory by December 3.
Read the full story