Understanding the React2Shell Vulnerability and How to Detect Related Network Activity

The React2Shell vulnerability is a security flaw that can affect web applications built with React when user input is not properly sanitized before being rendered or executed. In these scenarios, attackers can inject crafted payloads—such as JavaScript or shell commands—that are unintentionally passed into unsafe execution contexts.

First reported in early December 2025, React2Shell has been associated not only with remote command execution risks but also with attempted data exfiltration to multiple external hosts. As a result, detection and investigation of related network activity is an important component of incident response.

How React2Shell works

In a typical React2Shell attack, an application may use user-supplied data in a way that it ends up being evaluated as code. For example, if user input is embedded into dynamically generated code or passed to a shell execution API without proper validation, an attacker can leverage this to gain unauthorized access, execute arbitrary commands on the server, or manipulate the client-side environment.  In addition to this vulnerability, it has been discovered that attempted data exfiltration to multiple hosts has been attempted.

Detecting React2Shell activity with network visibility

Like many modern exploits, React2Shell often includes a network-based component. Monitoring outbound and inbound traffic for known indicators can help identify exploitation attempts, confirm suspicious behavior, and support further investigation.

Riverbed NetProfiler and AppResponse can assist by detecting and alerting on traffic associated with known hosts and subnets linked to React2Shell-related activity. Both tools are available in multiple form factors, including hardware, virtual, and cloud-based deployments.

How NetProfiler can help

NetProfiler has several reports that can assist with detection and verification of network-based attacks. NetProfiler has two components that can be used in reports to determine if traffic is going to or coming from known hosts.  In this case, there are multiple sources with known hosts involved in the React2Shell and related attacks. 

By creating Host Groups or blacklist files containing the IP addresses or domains of these known hosts, NetProfiler can be used to monitor traffic to and from these destinations:

Once this is created, then reports and policies (automatic detection/alerting) can be created to alert on traffic to and from these hosts. An example policy would look like this:

Reports can also be run on-demand to review traffic involving the specified hosts, providing visibility into communication patterns and potential data movement. An example report would look like this:

In addition to this example, NetProfiler can be used more broadly to analyze traffic that originates outside the organization, supporting threat hunting and retrospective analysis.

How AppResponse can help

AppResponse can also utilize the same combination of Host Groups and Policies to detect traffic from specific hosts or domains. However, AppResponse can also utilize other advanced features, such as the WebTransactionAnalyzer module (WTA) to detect patterns that indicate attacks or successful exploitations. An example of a WTA definition for one of the known sites is below:

Once this is in place, AppResponse can detect and alert on activity involving known React2Shell-related sites, providing deeper insight into the nature of the traffic and supporting investigation workflows.

Mitigation considerations

While many security resources provide detailed remediation guidance, the following mitigation steps are recommended after identifying relevant activity using NetProfiler and AppResponse:

• Patch the affected React and Next.js modules to the correct levels
• Prioritize internet facing instnacnes
• Continue to monitor for activity
• Add WAF firewall rules where appropriate

The role of network visibility

The React2Shell vulnerability highlights the importance of secure coding practices in modern web development. By ensuring proper input handling and leveraging framework security features, developers can significantly reduce the risk of such attacks. As always, visibility is a cornerstone of network security—the powerful Riverbed NetProfiler and AppResponse can give you deeper awareness of everything happening in your network both in real-time and historically.