[Security Vulnerability] Critical Remote Code Execution (RCE) via CVE-2025-55182 (React2Shell)

[r00xat]

Critical Security Vulnerability: Remote Code Execution (RCE)

A critical security vulnerability has been identified in PortNote, which allows for Remote Code Execution (RCE). This issue appears to be related to the underlying technology/framework components leveraged by the application, specifically the vulnerability tracked as "CVE-2025-55182 (React2Shell)".

The vulnerability was successfully verified using a publicly available scanner for CVE-2025-55182.

Do NOT expose PortNote publicly.

[Fifthdread]

Yep, I just got hit myself even though I thought I was safe. Thankfully I caught it quick. Someone installed a crypto miner on my portnote instance.