What happened
Security researchers disclosed a critical React2Shell flaw that allows attackers to run arbitrary JavaScript code in React and Next.js applications. The issue occurs when developers use dangerouslySetInnerHTML with untrusted input, which bypasses key security controls.
Who is affected
Engineering teams that build or maintain React or Next.js applications, especially those handling user generated content or older components that rely on unsafe rendering methods.
Why CISOs should care
React and Next.js support many enterprise web applications. A weakness in how these frameworks handle injected code raises the risk of account takeover, data exposure, and broader supply chain compromise.
3 practical actions
-
Review all React and Next.js codebases for dangerouslySetInnerHTML and replace or sanitize any unsafe uses.
-
Follow updated security guidance from React and Next.js and enforce linting rules that block unsafe patterns.
-
Improve input validation and sanitization across frontend and backend systems to reduce injection risks.