zlacker

[return to "Critical RCE Vulnerabilities in React and Next.js"]
1. _pdp_+Uc[view] [source] 2025-12-03 16:58:16
>>gonepi+(OP)
I don't have time to look into it right now (def later)!

However, I was curious to see if github copilot can reverse engineer it based on the latest commits and seems that what it is saying aligns with both advisories. It pointed out that it has to do with circular reference handling which sounds to me something that can be easily overlooked.

While this analysis might be completely off, the simple fact that I could get even this information without much efforts is mind-boggling. With better setup it might be able to get more.

With AI now being common place, coordinated timely disclosure is even more important considering the stakes. It is theoretically possible to get an exploit working within minutes. Considering that we see one of these major vulnerabilities annually (and it seems to me around the same time of the year) a bad actor can easily capitalise on the opportunities when presented.

◧◩
2. rvnx+ef[view] [source] 2025-12-03 17:07:42
>>_pdp_+Uc
It's easier for a bad actor to get an exploit, than for an operator to test his own site if the upgrade succeded
◧◩◪
3. _pdp_+og[view] [source] 2025-12-03 17:12:57
>>rvnx+ef
An operator might not be able to upgrade at all!

Along the fixes, the advisories now need to contain detailed workarouds, firewall rules and other adhoc solutions to ensure they get quickly deployed.

◧◩◪◨
4. rvnx+eh[view] [source] 2025-12-03 17:16:30
>>_pdp_+og
A guide for mitigation is way more useful so we can back port only the fix and test if the fix works.
[go to top]