Description
A pre-authentication remote code execution vulnerability exists in React Server Components versions 19.0.0, 19.1.0, 19.1.1, and 19.2.0 including the following packages: react-server-dom-parcel, react-server-dom-turbopack, and react-server-dom-webpack. The vulnerable code unsafely deserializes payloads from HTTP requests to Server Function endpoints.
Remediation
References
Related Vulnerabilities
WordPress Plugin Crelly Slider Arbitrary File Upload (1.3.4)
Atlassian Jira Cross-Site Request Forgery (CSRF) Vulnerability (CVE-2019-20099)
WordPress Plugin Limit Login Attempts Cross-Site Scripting (1.7.1)
Moodle Exposure of Sensitive Information to an Unauthorized Actor Vulnerability (CVE-2020-25703)
WordPress Plugin Image Gallery-Responsive Photo Gallery Cross-Site Scripting (1.5.1)