Post

It's kinda crazy how React went from "it's just a super lightweight rendering library, bro" to "whoopsie, our server-side execution layer's complex custom data-format serializer had a prototype-pollution bug and now it's a CVE-10 RCE."

Marko Poutiainen

@markopoutiainen.eurosky.social

9 Dec 2025

The whole idea that you can basically pass code in a call is very, very risky. That they wouldn't check what that code is in run-time is something else.

Georg Unterholzner

@georg.dev

Tbf, the bug was very subtle which is also why it took so long to be found. But you're right, the whole feature seems like a high risk, low reward situation. It's cool tech but nothing I'd want to use in prod.

10/12/25, 7:24 am0 reposts1 like

No replies yet.