This vulnerability (CVE-2025-55182) does not affect OneLogin.
The CVE is specific to React Server Components (RSC) - a server-side rendering feature that deserializes HTTP requests in a way that allows RCE. It affects the react-server-dom-* packages used by frameworks like Next.js App Router.
Our React applications (web-profile, web-portal) are traditional client-side SPAs built with Create React App and Vite respectively. They:
- Do not use React Server Components
- Do not use Next.js
- Do not include any react-server-dom-* packages
- Are served as static files - there is no server-side React execution
