{
  "advisory": {
    "aliases": [
      "GHSA-fv66-9v8q-g76r"
    ],
    "cwes": [
      "CWE-502"
    ],
    "kev_added": "2025-12-05",
    "sources": [
      "https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2025-55182",
      "https://react.dev/blog/2025/12/03/critical-security-vulnerability-in-react-server-components",
      "https://github.com/advisories/GHSA-fv66-9v8q-g76r"
    ]
  },
  "artifact": {
    "comparison_report_input_digest": "sha256:22c878caf8c52cbfced230b441f7e3cfddb54b2ff82806af2cb019307afbc259",
    "digest": "sha256:0e43ccb85ed834ceba8c9a16bfbef25deef1efd72fbd0013ade6481f38282232",
    "intelligence_snapshot_digest": "sha256:dec51a438c2a24f7c01c2f4e57783a87f4c809702b26e02b410aae2750a4bbe4"
  },
  "boundary_claim": false,
  "boundary_crossed": "guest filesystem outside workload root through code execution",
  "conclusion": "EXPLOITABLE_MVM_BENEFIT_NOT_PROVEN",
  "coverage_gap": "Supply-chain and build-time containment are not covered by the current HTTP-only comparison harness.",
  "cve_id": "CVE-2025-55182",
  "editorial": {
    "attribution": "TinyLabs MVM assurance corpus maintainers",
    "rationale": "CVSS 10, CISA KEV-listed unauthenticated RCE in React Server Components, widely reported as React2Shell.",
    "selected_on": "2026-09-05"
  },
  "headline": "Your app is exploitable; MVM protection is not yet proven",
  "package": {
    "affected_version": "19.0.0",
    "ecosystem": "npm",
    "fixed_version": "19.0.1",
    "name": "react-server-dom-webpack"
  },
  "proof": {
    "boundary_evidence_refs": [
      "mvm:observation:sha256:8cdddc5f40eab8027fea5cd976acda99e6e40e11320cc3b962319cf45dad20be",
      "mvm:proof:sha256:043e1ba3f25956a0f33b075178693ffbe9c10e656a5b87b422a0f9cc326f49c5"
    ],
    "observation_digest": "sha256:8cdddc5f40eab8027fea5cd976acda99e6e40e11320cc3b962319cf45dad20be",
    "proof_binding_digest": "sha256:043e1ba3f25956a0f33b075178693ffbe9c10e656a5b87b422a0f9cc326f49c5",
    "proof_id": "cve-2025-55182-tier1",
    "trial_id": "cve-2025-55182-local"
  },
  "refresh": {
    "cadence": "on_input_change_and_at_least_quarterly",
    "retirement": "stop_active_publication_when_corpus_status_changes"
  },
  "residual_risk": "MVM does not make malicious React Flight payloads safe; upgrade every affected RSC package and framework to a currently supported patched release.",
  "schema": "mvm.assurance.cve-publication/v1",
  "source_revision": "cf93d929435fd22b895cfbd00e61c83475651e69",
  "tier": "tier1_non_certifying",
  "tier2": {
    "blocking_issue": 22,
    "detail": "The corpus workload and net=false guest are wired, but a certifying admitted-provider attestation root is not yet available.",
    "reason_code": "attested_provider_unavailable",
    "status": "skipped"
  }
}