Advisory 114

CERT VU advisories & alerts disclose current reported cyber security vulnerabilities and threats identified in Vanuatu. The advisories deliver provide a summary of the threat analysed. Descriptions of the threat reported and mitigation procedures are provided as part of the advisory on how to mitigate the threats to minimise their impacts. Finally, a Traffic Light Protocol (TLP: Colour – See guides page for more information) indicator to show the level or information security and sharing rights.

Critical remote code execution (RCE) vulnerability

Release Date: 03rd of December 2025

Impact : HIGH / CRITICAL

TLP Rating: Clear

CERT Vanuatu (CERTVU) and the Department of Communication and Digital Transformation (DCDT) provide the following advisory.

This alert is relevant to Organizations and System/Network administrators that utilize the above products. This alert is intended to be understood by technical users and systems administrators.

What is it?

CVE-2025-55182 (also dubbed “React2Shell”) is a critical remote-code-execution (RCE) vulnerability in React Server Components (RSC).
The vulnerability stems from unsafe deserialization of incoming HTTP request payloads in the “Flight” protocol handling RSC — malformed or malicious payloads can trigger arbitrary code execution on the server.

What are the Systems affected?

What does this means?

Mitigation process

References

Download advisory (English): Critical remote code execution (RCE) vulnerability
Download advisory (Bislama): Kritikol vulnerabiliti long saed blong remote code execution (RCE)
Download advisory (French): Vulnérabilité critique d'exécution de code à distance (RCE)

Quick Links

Start a Conversation

+678 33380
info@cert.gov.vu

Main Menu

Our Security Advisories