A deep technical analysis of the React Flight protocol's deserialization attack surface, centered on CVE-2025-55182 (React2Shell), a CVSS 10.0 unauthenticated RCE vulnerability. The Flight protocol uses a custom streaming format with a `$` prefix system that reconstructs executable references, module imports, and RPC endpoints on the client. The root cause was a missing `hasOwnProperty` check in `getOutlinedModel`, allowing prototype chain traversal via `$:` path references to reach the `Function` constructor and execute arbitrary code. The exploit was weaponized by North Korean state actors within hours of disclosure. The article covers the full gadget chain, the React team's patch, and a ranked set of defenses: schema validation on every Server Action (Zod/Valibot), the `server-only` package, CSRF hardening, version verification, the Taint API's limitations, and WAF rules. Additional structural risks including MITM on the Flight stream, Server Action enumeration, encrypted closure tampering, and supply chain activation via module IDs are also examined.
