Telegram Group & Telegram Channel
Forwarded from Заметки Слонсера (Slonser)
https://react.dev/blog/2025/12/03/critical-security-vulnerability-in-react-server-components
React UNAUTH RCE
CVSS 10
По патчу успел понять в чем проблема (PoC пока пишу)
Уже сейчас могу сказать что похоже действительно уязвимы прям стандартные версии
То есть разработчику не нужно даже написать стремный код / использовать конкретный модуль
Достаточно написать:
npx create-next-app

То есть имеем очень страшное RCE by default на миллионах сайтов
Реверсим патч и лутаем миллионы на багбаунти...
🔥16🫡71



group-telegram.com/tech_b0lt_Genona/5917
Create:
Last Update:

https://react.dev/blog/2025/12/03/critical-security-vulnerability-in-react-server-components
React UNAUTH RCE
CVSS 10
По патчу успел понять в чем проблема (PoC пока пишу)
Уже сейчас могу сказать что похоже действительно уязвимы прям стандартные версии
То есть разработчику не нужно даже написать стремный код / использовать конкретный модуль
Достаточно написать:

npx create-next-app

То есть имеем очень страшное RCE by default на миллионах сайтов
Реверсим патч и лутаем миллионы на багбаунти...

BY Технологический Болт Генона


Warning: Undefined variable $i in /var/www/group-telegram/post.php on line 260

Share with your friend now:
group-telegram.com/tech_b0lt_Genona/5917

View MORE
Open in Telegram


Telegram | DID YOU KNOW?

Date: |

Telegram has become more interventionist over time, and has steadily increased its efforts to shut down these accounts. But this has also meant that the company has also engaged with lawmakers more generally, although it maintains that it doesn’t do so willingly. For instance, in September 2021, Telegram reportedly blocked a chat bot in support of (Putin critic) Alexei Navalny during Russia’s most recent parliamentary elections. Pavel Durov was quoted at the time saying that the company was obliged to follow a “legitimate” law of the land. He added that as Apple and Google both follow the law, to violate it would give both platforms a reason to boot the messenger from its stores. The War on Fakes channel has repeatedly attempted to push conspiracies that footage from Ukraine is somehow being falsified. One post on the channel from February 24 claimed without evidence that a widely viewed photo of a Ukrainian woman injured in an airstrike in the city of Chuhuiv was doctored and that the woman was seen in a different photo days later without injuries. The post, which has over 600,000 views, also baselessly claimed that the woman's blood was actually makeup or grape juice. Just days after Russia invaded Ukraine, Durov wrote that Telegram was "increasingly becoming a source of unverified information," and he worried about the app being used to "incite ethnic hatred." Update March 8, 2022: EFF has clarified that Channels and Groups are not fully encrypted, end-to-end, updated our post to link to Telegram’s FAQ for Cloud and Secret chats, updated to clarify that auto-delete is available for group and channel admins, and added some additional links. In view of this, the regulator has cautioned investors not to rely on such investment tips / advice received through social media platforms. It has also said investors should exercise utmost caution while taking investment decisions while dealing in the securities market.
from us


Telegram Технологический Болт Генона
FROM American