🚨 v2025.8.5.5 - React2Shell CVE-2025-55182 Detection

🚨 React2Shell CVE Detection (CVSS 10.0)

This release adds automatic detection for CVE-2025-55182 "React2Shell" - a critical RCE vulnerability affecting React Server Components and Next.js.

What's New

• React2ShellScanner - New scanner detecting vulnerable React/Next.js versions
• urllib3 CVE fixes - Updated to 2.6.0+ (CVE-2025-66418, CVE-2025-66471)
• 64 total scanners - Up from 63

Vulnerable Versions Detected

Package	Vulnerable	Fixed
React	19.0.0 - 19.2.0	19.0.1+
Next.js	15.0.0 - 15.0.4	15.0.5+
Next.js (canary)	14.3.0-canary.77 - 16.0.6	See advisory

Quick Check

pip install --upgrade medusa-security
medusa scan .

Scans: package.json, package-lock.json, yarn.lock, pnpm-lock.yaml

Full Changelog

v2025.8.5.4...v2025.8.5.5