GHSA-vr6p-vq2p-6j74: Withdrawn Advisory: LikeC4 has RCE through vulnerable React and Next.js versions
This advisory was withdrawn on Dec 22, 2025. The publisher no longer considers it a valid vulnerability.
Withdrawn Advisory This advisory has been withdrawn because LikeC4 isn’t impacted by CVE-2025-55182 because it doesn’t ship React. React is a peer dependency. Original Description LikeC4 uses React and Next.js: which contain known RCE vulnerabilities, as seen in CVE-2025-55182. [2025-12-15] Edit: the last fixes published by React were not thorough, a new set of fix releases completes the mitigation;
Published Dec 15, 2025 · Updated Dec 22, 2025
Affected packages
likec4
- Ecosystem
- npm
- Affected
- <= 1.46.1
- Fixed in
- No patched version yet
- Check
npm ls likec4
Advisory details
From the GitHub Advisory Database (CC BY 4.0).
Withdrawn Advisory
This advisory has been withdrawn because LikeC4 isn’t impacted by CVE-2025-55182 because it doesn’t ship React. React is a peer dependency.
Original Description
LikeC4 uses React and Next.js: which contain known RCE vulnerabilities, as seen in CVE-2025-55182.
[2025-12-15] Edit: the last fixes published by React were not thorough, a new set of fix releases completes the mitigation; see https://react.dev/blog/2025/12/11/denial-of-service-and-source-code-exposure-in-react-server-components
Credited to fnuttens, davydkov.
References
- https://github.com/likec4/likec4/security/advisories/GHSA-vr6p-vq2p-6j74
- https://nvd.nist.gov/vuln/detail/CVE-2025-55182
- https://react.dev/blog/2025/12/11/denial-of-service-and-source-code-exposure-in-react-server-components
- https://github.com/github/advisory-database/pull/6561#issue-3745533679
- https://github.com/advisories/GHSA-vr6p-vq2p-6j74
How this page is made: the data panel comes from the GitHub Advisory Database, CISA’s KEV catalog, the NVD and FIRST EPSS, and updates twice a day. No analysis has been written for this entry yet. Methodology