CVE2025

CVE-2025-55182

2Rules

4References

1Folders

2025-12-05Latest

Summary

CVE-2025-55182 is tracked here through 2 Sigma detections for exploitation attempts and related post-exploitation behavior observed in 2025. Coverage centers on linux / process_creation, windows / process_creation.

Related Detections

Search this threat

highexperimentalEmerging Threat

Linux Suspicious Child Process from Node.js - React2Shell

Detects suspicious child processes spawned from Node.js server processes on Linux systems, potentially indicating remote code execution exploitation such as CVE-2025-55182 (React2Shell). This rule particularly looks for exploitation of vulnerability on Node.js Servers where attackers abuse Node.js child_process module to execute arbitrary system commands. When execSync() or exec() is used, the command line often includes a shell invocation followed by suspicious commands or scripts (e.g., /bin/sh -c <malicious-command>). For other methods, the Image field will show the spawned process directly.

linuxprocess_creation

2025-12-05

highexperimentalEmerging Threat

Windows Suspicious Child Process from Node.js - React2Shell

Detects suspicious child processes started by Node.js server processes on Windows, which may indicate exploitation of vulnerabilities like CVE-2025-55182 (React2Shell). Attackers can abuse the Node.js 'child_process' module to run system commands or scripts using methods such as spawn(), exec(), execFile(), fork(), or execSync(). If execSync() or exec() is used in the exploit, the command line often shows a shell (e.g., cmd.exe /d /s /c ...) running a suspicious command unless other shells are explicitly invoked. For other methods, the spawned process appears directly in the Image field unless a shell is explicitly used.

windowsprocess_creation2 samples

2025-12-05

References