zlacker

>>rayhaa+(OP)
The CVE says the that flaw is in React Server Components, which implies strongly that this is a RCE on the backend (!!), not the client.

>>ajross+La
Where else would it be? What would an RCE of the client even mean?

>>padjo+Hs
it would be an RCE on your own machine :D