Skip to content
  • There are no suggestions because the search field is empty.

How do I create a profile to only scan React2shell vulnerability (CVE-2025-55182)

To create a profile to only scan React2shell vulnerability, follow the steps below:

For remote/active detection (unauthentication):

  1. Log in to Security Center.
  2. Click Scan network > Scan profiles.
  3. Click +Create scan profile > Network scan profile.
  4. Under General settings choose Basic.
  5. Under Ports coverage change the TCP to Full scan. 
  6. Under Vulnerabilities > include the HID-2-1-5314954 – React / Next.js Deserialization RCE (CVE-2025-55182) – Active Detection
  7. Scroll down and ensure that this scan test is unchecked Skip tests that perform active break-in attempts.
  8. Click Submit to save.
  9. Done!


For authenticated scan:

  1. Log in to Security Center.
  2. Click Scan network > Scan profiles.
  3. Click +Create scan profile > Network scan profile
  4. Under General settings choose Basic.
  5. Under Ports coverage change the TCP to Full scan. 
  6. Under Vulnerabilities > include:
    1. HID-2-1-5314953 – Next.js React Component RCE Vulnerability (aka React2Shell) – CVE-2025-55182
    2. HID-2-1-5314950 – React Server Component RCE Vulnerability (aka React2Shell) – CVE-2025-55182
  7. Scroll down and ensure that this scan test is unchecked Skip tests that perform active break-in attempts.
  8. Under Authentication, ensure that you have set the correct authentication records.
  9. Click Submit to save.
  10. Done!

Important note for Windows targets
Authentication scans on Windows machines must allow execution of PowerShell commands in the scan configuration: https://support.holmsecurity.com/knowledge/what-is-the-impact-of-powershell-commands-in-authenticated-network-scans

Running scans with the local Scanner Appliance
To be able to detect the React2shell vulnerability with the local Scanner Appliance, ensure that you at least have this signature date 202512060106.