# React2Shell Impact Report

On December 3, 2025, a critical unauthenticated remote code execution (RCE) vulnerability was disclosed in React Server Components, known as React2Shell (CVE-2025-55182, CVE-2025-55183, CVE-2025-55184, and CVE-2025-67779). To learn more about the vulnerability, see our [React2Shell response documentation](https://help.sonatype.com/en/find-and-fix-react2shell.html "Find and Fix React2Shell").

To help you assess which of your components and applications are impacted, Sonatype has released a _React2Shell Impact Report_.

**Tip**  
Sonatype’s vulnerability detection operates at the **file level**, not just the component level. Our report results reflect only the vulnerabilities present in the specific files included in your components and applications. This precision helps eliminate noise and ensures you're focused on real risk.

## About the React2Shell Impact Report

The _React2Shell Impact Report_ provides a high-level summary of React2Shell vulnerability impact, showing how affected applications and components are distributed across your organization.

This report helps security and development teams:

- Identify applications impacted by React2Shell vulnerabilities.
- Understand which components and versions are affected.
- Track remediation progress across applications.
- Review waiver status at a glance.

The report focuses on visibility and awareness, not detailed remediation execution.

### Impact Summary

When you open the _React2Shell Impact Report_, summary metrics at the top of the page provide an immediate view of overall impact, including:

- Number of affected applications
- Number of affected components
- Number of violating components
- Number of active waivers

These metrics reflect the most recent application evaluation data and update after each scan.

**Note**  
The _React2Shell Impact Report_ currently addresses only the following CVEs: CVE-2025-55182, CVE-2025-55183, CVE-2025-55184, and CVE-2025-67779.

### Impact Summary Table

Below the summary metrics, the impact table provides a detailed view of affected components across applications.

The table includes information such as the following:

- Application
- Stage
- Component
- Component version
- Vulnerability ID
- Recommended action
- Active waiver status
- Evaluation status

You can sort the table by column and use pagination controls to navigate large result sets. This allows teams to quickly review affected areas and prioritize follow-up actions.

### Exporting the Report

You can export the _React2Shell Impact Report_ directly from the Sonatype Lifecycle user interface and download the report data as a CSV file. Alternatively, you can use the `downloadComponentSearchReport` endpoint in the [Component Search REST API](https://help.sonatype.com/en/component-search-rest-api.html "Component Search REST API").

To download the CSV from the user interface, take the following actions:

1. In the Lifecycle user interface, navigate to _Enterprise Reporting_ → _React2Shell Impact Report_ or to _Operational Reporting_ → _React2Shell Impact Report_ if your organization does not use Enterprise Reporting.
2. Select _Download CSV_ to download the CSV file that contains the report information.

The downloaded file includes information about component versions, implicated files, suggested remediation actions, and any active waivers.

**Note**  
Report details are limited to your user permission level. For full details, be sure to download the report using an administrator account with full permissions.