I’m done with any project using electron,react,next and similar node based projects with dependencies hells. The fact you guys are advertising as “audited” will also blindly lead people in bad situations. You should have a security.txt or at least be transparent with the user. React2Shell Deep Dive: CVE-2025-55182 Exploit Mechanics | Wiz Blog
I Like the project, protocol but the chain of supply is a major problem, chromium binary as well.
I honestly done with any applications like I just stated
| http://www.openwall.com/lists/oss-security/2025/12/03/4 | CVE | Mailing List Patch Third Party Advisory |
|---|---|---|
| China-nexus cyber threat groups rapidly exploit React2Shell vulnerability (CVE-2025-55182) | AWS Security Blog | CISA-ADP | Third Party Advisory |
| RCE Vulnerability in React and Next.js | Hacker News | CVE | Issue Tracking |
| Critical Security Vulnerability in React Server Components – React | Facebook, Inc. | Patch Vendor Advisory |
| https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2025-55182 | CISA-ADP | US Government Resource |
| https://www.facebook.com/security/advisories/cve-2025-55182 | Facebook, Inc. | Vendor Advisory |
This CVE is in CISA’s Known Exploited Vulnerabilities Catalog
Reference CISA’s BOD 22-01 and Known Exploited Vulnerabilities Catalog for further guidance and requirements.
| Vulnerability Name | Date Added | Due Date | Required Action |
|---|---|---|---|
| Meta React Server Components Remote Code Execution Vulnerability | 12/05/2025 | 12/12/2025 | Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable. |
Weakness Enumeration
| CWE-ID | CWE Name | Source |
|---|---|---|
| CWE-502 | Deserialization of Untrusted Data |  NIST |
Known Affected Software Configurations Switch to CPE 2.2
Configuration 1 (hide)
| cpe:2.3:a:facebook:react:19.0.0:*:*:*:*:*:*:* Show Matching CPE(s) |
|---|
| cpe:2.3:a:facebook:react:19.1.0:*:*:*:*:*:*:* Show Matching CPE(s ) |
| cpe:2.3:a:facebook:react:19.1.1:*:*:*:*:*:*:* Show Matching CPE( s) |
| cpe:2.3:a:facebook:react:19.2.0:*:*:*:*:*:*:* |
In the famous fairy tale “The Emperor’s New Clothes,” the Emperor is tricked into believing he is wearing a magnificent robe when naked. This story is a metaphor for the dangers of blindly trusting open-source software without carefully evaluating its security risks. Just as the Emperor’s courtiers were afraid to speak up for fear of being ridiculed, many organizations are hesitant to criticize open-source software for fear of being seen as behind the times or ungrateful.
The very openness that fuels open-source software popularity creates a double-edged sword. While readily available source code fosters collaboration and rapid innovation, it also grants adversaries a detailed map of potential vulnerabilities. Imagine a castle with its blueprints plastered on the gatehouse walls; any cunning foe could exploit hidden passages or weaknesses in the defenses. This transparency makes open-source software a lucrative target for malicious actors, particularly nation-state actors and sponsored advanced persistent threats (APTs) with sophisticated attack capabilities.<
The Emperor’s delusion is often apparent in the open-source software community. FOMO, hype, and bandwagon effects can propel certain projects to stardom without thorough security scrutiny. Organizations eager to embrace the latest shiny tool may overlook critical vulnerabilities, exposing themselves to potential breaches with catastrophic consequences. Just because everyone admires the “beautiful” Emperor’s non-existent attire does not make it real. [1]
Delta Chat version
Post your group on the social media, wait 1-2 days or grab of many react2shell PoC and adapt it for delta chat.
Screen snapshots
Debug logs https://paste.sh/978f576b-5ef5-4347-83f4-66804158a677
https://paste.sh/978f576b-5ef5-4347-83f4-66804158a677
Logs
<!--
ansport 6: IDLE entering wait-on-remote state in folder \"INBOX\"."
2026-08-04T21:05:29.006Z core/event INFO "" 9 "src/imap/select_folder.rs:41: Expunge messages in \"INBOX\"."
2026-08-04T21:05:29.122Z core/event INFO "" 9 "src/imap/select_folder.rs:44: Close/expunge succeeded."
2026-08-04T21:05:29.237Z core/event INFO "" 9 "src/imap/select_folder.rs:78: Transport 1: Selected folder \"INBOX\"."
2026-08-04T21:05:29.349Z core/event INFO "" 9 "src/imap/idle.rs:67: Transport 1: IDLE entering wait-on-remote state in folder \"INBOX\"."
2026-08-04T21:06:00.475Z core/event INFO "" 1 "src/ephemeral.rs:614: Ephemeral loop waiting for deletion in 156h 40m 13s or interrupt"
2026-08-04T21:06:00.489Z core/event INFO "" 1 "src/mimefactory.rs:479: Scale up origin of Chat#12 recipients to IncomingTo."
2026-08-04T21:06:00.493Z core/event INFO "" 1 "src/chat.rs:2884: Message Msg#3077 will be sent in one shot (no pre- and post-message). Size: 6.28 KiB."
2026-08-04T21:06:00.494Z core/event INFO "" 1 "src/scheduler.rs:613: SMTP fake idle interrupted."
2026-08-04T21:06:00.499Z core/event INFO "" 1 "src/smtp.rs:538: Selected rows from SMTP queue: [1030]."
2026-08-04T21:06:00.499Z core/event INFO "" 1 "src/smtp.rs:386: Try number 1 to send message Msg#3077 (entry 1030) over SMTP."
2026-08-04T21:06:00.530Z renderer/message-parser ERROR "\nparseAndRenderMessage (file:///app/delta/resources/app/src/components/message/MessageParser.tsx:152:9),\nComponent (file:///app/delta/resources/app/src/components/message/MessageBody.tsx:99:10),\nrenderWithHooks (file:///app/delta/node_modules/.pnpm/react-dom@19.2.0_react@19.2.0/node_modules/react-dom/cjs/react-dom-client.production.js:4351:21),\nupdateFunctionComponent (file:///app/delta/node_modules/.pnpm/react-dom@19.2.0_react@19.2.0/node_modules/react-dom/cjs/react-dom-client.production.js:6497:15),\nupdateSimpleMemoComponent (file:///app/delta/node_modules/.pnpm/react-dom@19.2.0_react@19.2.0/node_modules/react-dom/cjs/react-dom-client.production.js:6237:10),\nupdateMemoComponent (file:///app/delta/node_modules/.pnpm/react-dom@19.2.0_react@19.2.0/node_modules/react-dom/cjs/react-dom-client.production.js:6178:9),\nbeginWork (file:///app/delta/node_modules/.pnpm/react-dom@19.2.0_react@19.2.0/node_modules/react-dom/cjs/react-dom-client.production.js:7784:14),\npM (file:///app/delta/node_modules/.pnpm/react-dom@19.2.0_react@19.2.0/node_modules/react-dom/cjs/react-dom-client.production.js:11305:14)" "parseAndRenderMessage failed:" {"input":"Warez (scene) Related\n\nWhat is Warez/The Scene?\nwikipedia.org/wiki/Warez 9/5/13\nwikipedia.org/wiki/Warez_scene 9/5/13\nwikipedia.org/wiki/Warez_group 9/5/13\nwikipedia.org/wiki/List_of_warez_groups 9/5/13\nwikipedia.org/wiki/Topsite_(warez) 10/3/13\nwikipedia.org/wiki/Nuke_(warez) 4/22/15\nwikipedia.org/wiki/Standard_(warez) 9/5/13\nwikipedia.org/wiki/.nfo 4/22/15\nwikipedia.org/wiki/Pirated_movie_release_types 9/5/13\nwikipedia.org/wiki/Copyright_infringement_of_software 9/5/13\nwikipedia.org/wiki/Copyright_infringement_of_audio-visual_works 9/5/13\nwikipedia.org/wiki/Operation_Buccaneer 10/3/13\nwikipedia.org/wiki/Operation_Fastlink 10/3/13\nwikipedia.org/wiki/Operation_Safehaven 4/22/15\nwikipedia.org/wiki/Operation_Site_Down 4/22/15\nwikipedia.org/wiki/Bulletin_board_system 10/3/13\n\nNo Copy (2008) (a brief history of piracy/filesharing) 10/3/13\n\nwired.com/2005/01/topsite/ 9/5/13\namazon.com/How-Music-Got-Free-Industry/dp/0525426612 | new yorker | vice 10/14/15\namazon.com/Software-Piracy-Exposed-Paul-Craig/dp/1932266984 (mediafire) 11/5/16\nfirstmonday.org/ojs/index.php/fm/article/view/5546/4125 10/15/14\ndl.acm.org/citation.cfm?id=2858036.2858341 (sci-hub link) 6/3/16\nonlinelibrary.wiley.com/doi/10.1002/1944-2866.POI369/abstract (sci-hub link) 7/9/16\n2600_Guide_to_Internet_Piracy-TYDJ.txt (from archive.org) 9/5/13\n\nreddit.com/r/IAmA/iama_ex_warez_scene_member_ama/ 4/15/14\nreddit.com/r/IAmA/i_run_a_topsite_ftp_server_and_im_in_the_piracy/ 5/13/14\nreddit.com/r/IAmA/i_cracked_software_for_the_warez_appsgames_scene/ 5/13/14\nreddit.com/r/IAmA/iama_for_9_years_i_was_a_member_in_some_of_the/ 5/13/14\nreddit.com/r/IAmA/i_was_in_a_major_mp3_releasing_group_in_the/ 5/13/14\nreddit.com/r/IAmA/hi_reddit_iama_now_retired_scener_who_was_a/ 5/13/14\nreddit.com/r/trackers/iama_retired_member_of_the_piracy_scene_amaa/ 5/13/14\n[...]","error":{"stack":"TypeError: Failed to construct 'URL': Invalid URL\n at renderElement (file:///app/delta/resources/app/src/components/message/MessageParser.tsx:50:19)\n at file:///app/delta/resources/app/src/components/message/MessageParser.tsx:147:11\n at Array.map (<anonymous>)\n at parseAndRenderMessage (file:///app/delta/resources/app/src/components/message/MessageParser.tsx:146:19)\n at Component (file:///app/delta/resources/app/src/components/message/MessageBody.tsx:99:10)\n at renderWithHooks (file:///app/delta/node_modules/.pnpm/react-dom@19.2.0_react@19.2.0/node_modules/react-dom/cjs/react-dom-client.production.js:4351:21)\n at updateFunctionComponent (file:///app/delta/node_modules/.pnpm/react-dom@19.2.0_react@19.2.0/node_modules/react-dom/cjs/react-dom-client.production.js:6497:15)\n at updateSimpleMemoComponent (file:///app/delta/node_modules/.pnpm/react-dom@19.2.0_react@19.2.0/node_modules/react-dom/cjs/react-dom-client.production.js:6237:10)\n at updateMemoComponent (file:///app/delta/node_modules/.pnpm/react-dom@19.2.0_react@19.2.0/node_modules/react-dom/cjs/react-dom-client.production.js:6178:9)\n at Rx (file:///app/delta/node_modules/.pnpm/react-dom@19.2.0_react@19.2.0/node_modules/react-dom/cjs/react-dom-client.production.js:7784:14)","message":"Failed to construct 'URL': Invalid URL"}}
2026-08-04T21:06:00.604Z core/event INFO "" 1 "src/smtp/send.rs:62: Message len=6427 was SMTP-sent to 20 recipients.."
2026-08-04T21:06:00.604Z core/event INFO "" 1 "src/smtp.rs:655: Sending MDNs."
2026-08-04T21:06:00.604Z core/event INFO "" 1 "src/scheduler.rs:581: SMTP fake idle started."
2026-08-04T21:06:00.604Z core/event INFO "" 1 "src/scheduler.rs:609: SMTP has no messages to retry, waiting for interrupt."
2026-08-04T21:06:00.634Z core/event INFO "" 1 "src/imap/idle.rs:90: \"INBOX\": Idle has NewData ResponseData { raw: 4096, response: MailboxData(Exists(1707)) }"
2026-08-04T21:06:00.651Z core/event INFO "" 1 "src/quota.rs:88: Transport 2: Updating quota."
2026-08-04T21:06:00.664Z core/event INFO "" 1 "src/quota.rs:106: Transport 2: Updated quota."
ansport 6: IDLE entering wait-on-remote state in folder \"INBOX\"."
2026-08-04T21:05:29.006Z core/event INFO "" 9 "src/imap/select_folder.rs:41: Expunge messages in \"INBOX\"."
2026-08-04T21:05:29.122Z core/event INFO "" 9 "src/imap/select_folder.rs:44: Close/expunge succeeded."
2026-08-04T21:05:29.237Z core/event INFO "" 9 "src/imap/select_folder.rs:78: Transport 1: Selected folder \"INBOX\"."
2026-08-04T21:05:29.349Z core/event INFO "" 9 "src/imap/idle.rs:67: Transport 1: IDLE entering wait-on-remote state in folder \"INBOX\"."
2026-08-04T21:06:00.475Z core/event INFO "" 1 "src/ephemeral.rs:614: Ephemeral loop waiting for deletion in 156h 40m 13s or interrupt"
2026-08-04T21:06:00.489Z core/event INFO "" 1 "src/mimefactory.rs:479: Scale up origin of Chat#12 recipients to IncomingTo."
2026-08-04T21:06:00.493Z core/event INFO "" 1 "src/chat.rs:2884: Message Msg#3077 will be sent in one shot (no pre- and post-message). Size: 6.28 KiB."
2026-08-04T21:06:00.494Z core/event INFO "" 1 "src/scheduler.rs:613: SMTP fake idle interrupted."
2026-08-04T21:06:00.499Z core/event INFO "" 1 "src/smtp.rs:538: Selected rows from SMTP queue: [1030]."
2026-08-04T21:06:00.499Z core/event INFO "" 1 "src/smtp.rs:386: Try number 1 to send message Msg#3077 (entry 1030) over SMTP."
2026-08-04T21:06:00.530Z renderer/message-parser ERROR "\nparseAndRenderMessage (file:///app/delta/resources/app/src/components/message/MessageParser.tsx:152:9),\nComponent (file:///app/delta/resources/app/src/components/message/MessageBody.tsx:99:10),\nrenderWithHooks (file:///app/delta/node_modules/.pnpm/react-dom@19.2.0_react@19.2.0/node_modules/react-dom/cjs/react-dom-client.production.js:4351:21),\nupdateFunctionComponent (file:///app/delta/node_modules/.pnpm/react-dom@19.2.0_react@19.2.0/node_modules/react-dom/cjs/react-dom-client.production.js:6497:15),\nupdateSimpleMemoComponent (file:///app/delta/node_modules/.pnpm/react-dom@19.2.0_react@19.2.0/node_modules/react-dom/cjs/react-dom-client.production.js:6237:10),\nupdateMemoComponent (file:///app/delta/node_modules/.pnpm/react-dom@19.2.0_react@19.2.0/node_modules/react-dom/cjs/react-dom-client.production.js:6178:9),\nbeginWork (file:///app/delta/node_modules/.pnpm/react-dom@19.2.0_react@19.2.0/node_modules/react-dom/cjs/react-dom-client.production.js:7784:14),\npM (file:///app/delta/node_modules/.pnpm/react-dom@19.2.0_react@19.2.0/node_modules/react-dom/cjs/react-dom-client.production.js:11305:14)" "parseAndRenderMessage failed:" {"input":"Warez (scene) Related\n\nWhat is Warez/The Scene?\nwikipedia.org/wiki/Warez 9/5/13\nwikipedia.org/wiki/Warez_scene 9/5/13\nwikipedia.org/wiki/Warez_group 9/5/13\nwikipedia.org/wiki/List_of_warez_groups 9/5/13\nwikipedia.org/wiki/Topsite_(warez) 10/3/13\nwikipedia.org/wiki/Nuke_(warez) 4/22/15\nwikipedia.org/wiki/Standard_(warez) 9/5/13\nwikipedia.org/wiki/.nfo 4/22/15\nwikipedia.org/wiki/Pirated_movie_release_types 9/5/13\nwikipedia.org/wiki/Copyright_infringement_of_software 9/5/13\nwikipedia.org/wiki/Copyright_infringement_of_audio-visual_works 9/5/13\nwikipedia.org/wiki/Operation_Buccaneer 10/3/13\nwikipedia.org/wiki/Operation_Fastlink 10/3/13\nwikipedia.org/wiki/Operation_Safehaven 4/22/15\nwikipedia.org/wiki/Operation_Site_Down 4/22/15\nwikipedia.org/wiki/Bulletin_board_system 10/3/13\n\nNo Copy (2008) (a brief history of piracy/filesharing) 10/3/13\n\nwired.com/2005/01/topsite/ 9/5/13\namazon.com/How-Music-Got-Free-Industry/dp/0525426612 | new yorker | vice 10/14/15\namazon.com/Software-Piracy-Exposed-Paul-Craig/dp/1932266984 (mediafire) 11/5/16\nfirstmonday.org/ojs/index.php/fm/article/view/5546/4125 10/15/14\ndl.acm.org/citation.cfm?id=2858036.2858341 (sci-hub link) 6/3/16\nonlinelibrary.wiley.com/doi/10.1002/1944-2866.POI369/abstract (sci-hub link) 7/9/16\n2600_Guide_to_Internet_Piracy-TYDJ.txt (from archive.org) 9/5/13\n\nreddit.com/r/IAmA/iama_ex_warez_scene_member_ama/ 4/15/14\nreddit.com/r/IAmA/i_run_a_topsite_ftp_server_and_im_in_the_piracy/ 5/13/14\nreddit.com/r/IAmA/i_cracked_software_for_the_warez_appsgames_scene/ 5/13/14\nreddit.com/r/IAmA/iama_for_9_years_i_was_a_member_in_some_of_the/ 5/13/14\nreddit.com/r/IAmA/i_was_in_a_major_mp3_releasing_group_in_the/ 5/13/14\nreddit.com/r/IAmA/hi_reddit_iama_now_retired_scener_who_was_a/ 5/13/14\nreddit.com/r/trackers/iama_retired_member_of_the_piracy_scene_amaa/ 5/13/14\n[...]","error":{"stack":"TypeError: Failed to construct 'URL': Invalid URL\n at renderElement (file:///app/delta/resources/app/src/components/message/MessageParser.tsx:50:19)\n at file:///app/delta/resources/app/src/components/message/MessageParser.tsx:147:11\n at Array.map (<anonymous>)\n at parseAndRenderMessage (file:///app/delta/resources/app/src/components/message/MessageParser.tsx:146:19)\n at Component (file:///app/delta/resources/app/src/components/message/MessageBody.tsx:99:10)\n at renderWithHooks (file:///app/delta/node_modules/.pnpm/react-dom@19.2.0_react@19.2.0/node_modules/react-dom/cjs/react-dom-client.production.js:4351:21)\n at updateFunctionComponent (file:///app/delta/node_modules/.pnpm/react-dom@19.2.0_react@19.2.0/node_modules/react-dom/cjs/react-dom-client.production.js:6497:15)\n at updateSimpleMemoComponent (file:///app/delta/node_modules/.pnpm/react-dom@19.2.0_react@19.2.0/node_modules/react-dom/cjs/react-dom-client.production.js:6237:10)\n at updateMemoComponent (file:///app/delta/node_modules/.pnpm/react-dom@19.2.0_react@19.2.0/node_modules/react-dom/cjs/react-dom-client.production.js:6178:9)\n at Rx (file:///app/delta/node_modules/.pnpm/react-dom@19.2.0_react@19.2.0/node_modules/react-dom/cjs/react-dom-client.production.js:7784:14)","message":"Failed to construct 'URL': Invalid URL"}}
2026-08-04T21:06:00.604Z core/event INFO "" 1 "src/smtp/send.rs:62: Message len=6427 was SMTP-sent to 20 recipients.."
2026-08-04T21:06:00.604Z core/event INFO "" 1 "src/smtp.rs:655: Sending MDNs."
2026-08-04T21:06:00.604Z core/event INFO "" 1 "src/scheduler.rs:581: SMTP fake idle started."
2026-08-04T21:06:00.604Z core/event INFO "" 1 "src/scheduler.rs:609: SMTP has no messages to retry, waiting for interrupt."
2026-08-04T21:06:00.634Z core/event INFO "" 1 "src/imap/idle.rs:90: \"INBOX\": Idle has NewData ResponseData { raw: 4096, response: MailboxData(Exists(1707)) }"
2026-08-04T21:06:00.651Z core/event INFO "" 1 "src/quota.rs:88: Transport 2: Updating quota."
2026-08-04T21:06:00.664Z core/event INFO "" 1 "src/quota.rs:106: Transport 2: Updated quota."
-->
