The bug allows attacker-controlled model servers to inject code, steal session tokens, and, in some cases, escalate to remote ...
December 2025, the RondoDox botnet operators have been targeting Next.js servers impacted by the React2Shell vulnerability.