React’s Biggest Security Crisis Yet: Understanding the Massive Server Exploit

The worst thing Vibe coders could ever have not had the foggiest idea about has happened. There's a new React server component exploit that's been given the CVSS score of 10 and is on fire. This is actually pretty a pretty big deal [music] that so 10 is it's 10 out of 10, right? So it's the worst critical. Yeah. The server is the safest place to be. It's where you store your environment variables. It's where you run code that means that people are authenticated that they um it's it's really like the last line of defense which should be bulletproof. Yet with an exploit that React um have exploited revealed on um their server components, you can run server actions with zero permissions like you can do anything. You can expose environment variables. You can contact databases. You can do all this. And [music] the nerdiness of it is in JavaScript everything is an object. Even functions are objects. Objects [music] have a hidden in fact if we were to uh inspect. So what I did there was I just created a new object, right? and then console log the object and automatically it's got this prototype and then inside of here you've got all of this secret stuff and this some of this stuff or some of this um and it basically exploits the the fact of this prototype that you can then run other you can access other bits of code on the server through this. So there was uh the get the get method. They were able to call the the secret get method on on um objects that can store that have data stored in them. So you know this is all incredibly like nerdy but just to know that this is kind of how they've exploited it. And if you're running anything Nex.js or whatever update update to the latest latest version that you can uh really simple you can ask claw code to do it. And they even worked out that payload haven't updated to the latest version of React. So it's the patch version that you want to want to update to. And then on top of that, within the last day, they found two more exploits that you need to update to. So if you updated based on this bloody this this exploit that's just happened, they found two more. One of them was a denial of service uh exploit. Another one was source code exposure um in this. So it's like yeah it's is on fire. It's pretty bad. It's pretty [music] bad. The the denial of service one is an also is is I don't think it's a 10 but it is pretty it's critical 7 7.5. So man and this has been by the way this has been in react since day dot. So they've got to they've got to provide this patch on all of the versions of react. Actually no has it been day dot or maybe day dot of server components which is like a year or two old or whatever. So there's a lot of um there's going to be a lot of websites out there that use this version. So yeah, pretty pretty big deal. And it goes into what you were saying as well about like software just becoming absolute garbage at the moment. Yeah. Like yeah, everything [music] like my browser crashed. So you see it there. You don't need to I mean the fact that you're just making the window size. What happens if you make the right hand side smaller? Has Has he crashed again? Guys, let me know in the comments. Has he crashed again? Cuz this happened last time. I might have a thousand tabs, but my computer should be able to handle that. We are talking about HTML. I don't know. I feel like we we see with this uh level of you know carelessness with AI like software will just get more and more trash. Uh we will have less optimization in most things and yeah um I you know I speculated it's it's in part due to the pressures [music] that developers are being put under to deliver fast. That is true. Yes. you know, quality assurance cuts on um QA testing and things like that. Like we're just it's gone from, you know, agile was this idea of delivering value quickly in order to learn and bring that back into the into the the tool or the product to learn what actually people want. But you still need a robust testing process to go along with that. Cuts are being made and all the rest of that maybe this information or this this this commitment or dedication to quality is just getting lost. [music] But I just I just don't know. I just do not know. This is part of a larger conversation on my show, Command AI, which we stream live every single week. We discuss the news and all things related to AI in the world of design and web. Catch us next week and join in the banter.