I think this is the fix for the React Server: https://github.com/facebook/react/pull/35277/files https://github.com/facebook/react/pull/35277/files It looks li

I think this is the fix for the React Server: https://github.com/facebook/react/pull/35277/files https://github.com/facebook/react/pull/35277/files It looks like it only affects dynamic reloading? If I understand correctly, the client can just politely ask the server to load arbitrary code, and the server agrees. This should never be enabled in production in the first place. I'm not surprised that they are fundamentally vulnerable, and this is likely not going to be the last RCE in this part of the code.