Security flaw allows attackers to inject malicious code into legitimate websites
Cybersecurity researchers are warning of a surge in crypto wallet drainers being silently deployed through a vulnerability in the widely used React JavaScript library. The issue has been linked to an unauthenticated remote code execution flaw, allowing attackers to inject and run malicious scripts on affected websites without authorization.
The vulnerability, identified as CVE-2025-55182, enables bad actors to compromise front-end code and embed wallet-draining logic into otherwise legitimate platforms, including crypto-related services and general websites.
Once exploited, attackers insert obfuscated JavaScript that prompts users to unknowingly sign malicious transactions. These drainers often appear as fake reward pop-ups or routine signature requests, tricking users into approving transfers that empty their wallets.
The threat is not limited to Web3 platforms. Any website using vulnerable React server components may be at risk.
Compromised websites may suddenly be flagged by browsers or security tools as phishing risks. Key indicators include:
- Unexpected external assets loading
- Unrecognized script hosts
- Wallet signature requests showing incorrect recipients
Website operators are urged to immediately audit their front-end code and hosting environments.
A fix was released on Dec. 3, and developers using react-server-dom-webpack, react-server-dom-parcel, or react-server-dom-turbopack are advised to upgrade immediately.
Applications not using server-side React components are not affected.
Disclaimer
This content is for informational purposes only and does not constitute financial, investment, or legal advice. Cryptocurrency trading involves risk and may result in financial loss.