INC-0006·Mercy Valley Community Hospital·Patient portalReplay of a real KEV entrySimulated hospital

Meta React Server Components flaw on the patient portal: contained without taking patient routes offline

CVE-2025-55182, Meta React Server Components (CISA KEV). The fixed version can't be installed today. Breakglass proves the flaw matters here, applies one reversible control, and proves patients can still book.

✓ CONTAINED

0:40

exposure closed, from ingest to verified

federal due window: 7 days

fig. 1 Evidence · two factors before any action

Could it happen here? Is it happening?

✓The code reaches the flawed partSemgrep · SEMGREP CE

targets/mercy-portal/app/appointments/actions.ts:6 React Server Function `bookAppointment` is exported from a "use server" module. Requests to it are decoded by react-server-dom-*; CVE-2025-55182 (CISA KEV) is a flaw in that decoding for affected versions.

export async function bookAppointment(slotId: string) {
  const session = await requireSession();
  return schedule.book(session.patientId, slotId);

targets/mercy-portal/app/appointments/page.tsx:10 A route component invokes server function `bookAppointment`, so the endpoint that decodes its payload is reachable from that route.

{s.label} <button onClick={() => bookAppointment(s.id)}>Book</button>

4 more findings

targets/mercy-portal/app/billpay/actions.ts:6 React Server Function `payBalance` is exported from a "use server" module. Requests to it are decoded by react-server-dom-*; CVE-2025-55182 (CISA KEV) is a flaw in that decoding for affected versions.

targets/mercy-portal/app/billpay/page.tsx:4 A route component invokes server function `payBalance`, so the endpoint that decodes its payload is reachable from that route.

targets/mercy-portal/app/messages/actions.ts:10 React Server Function `sendCareTeamMessage` is exported from a "use server" module. Requests to it are decoded by react-server-dom-*; CVE-2025-55182 (CISA KEV) is a flaw in that decoding for affected versions.

targets/mercy-portal/app/messages/page.tsx:4 A route component invokes server function `sendCareTeamMessage`, so the endpoint that decodes its payload is reachable from that route.

rule bg-rsc-server-action-defined · direct dependency react-server-dom-webpack 19.1.0 · 1.0 s

Custom rules over the portal source: server functions defined and invoked from 3 route(s). Semgrep Community Edition (no account); the affected version comes from the lockfile and OSV.

✓That route is being hit right nowClickHouse · CLICKHOUSE CLOUD

162 requests on 3 candidate routes in the last 5 min, 99 unblocked · 11 journey, 104 patient, 47 marker

ClickHouse decision: /portal/messages · 68 requests in 5 min, 5 unblocked, hostile traffic on this route → exposed route → BG-CTL-PORTAL-REQUIRE-SESSION-FOR-ACTIONS

The agent's query

SELECT route_id, client_kind, count() AS total, countIf(blocked = 0) AS unblocked
FROM bg.edge_requests
WHERE site = 'managed' AND route_id IN ('portal.book', 'portal.messages', 'portal.billpay')
  AND ts >= now() - INTERVAL 300 SECOND
GROUP BY route_id, client_kind

✓ BOTH FACTORS: MAY ACTStatic evidence alone, or traffic alone, never triggers a change.

fig. 2 Credential policy

Guild decides, not the model

Denied by policy

POST /admin/services/portal/shutdown

Rule guild:services_shutdown:DENY matched at Guild's credential proxy. DENY wins: Guild's credential proxy refused 'services_shutdown' before any request left Guild (Access to 'services_shutdown' is not permitted for this integration.). The hospital's playbook says strongest containment first, so the agent asked for BG-CTL-PORTAL-SHUTDOWN; the policy refused and its credential was never used for it.

Guild's own record: security_event · services_shutdown · DENY · FORBIDDEN (runtime_error) · 04:24:31 UTC

Escalation · disabledApproval calls are switched off in Settings (live calls cost money). The denial stands; nothing drastic happens without a human.

fig. 3 Decision · one control ID from the catalog

guild:code~breakglass-decision · structured output

BG-CTL-PORTAL-REQUIRE-SESSION-FOR-ACTIONS

Refuse server-action requests that carry no signed-in session

Semgrep confirmed all three server-actions (booking, messages, billpay) are reachable from code.
Live traffic shows hostile (nonpatient) traffic only on portal.messages, matching advisory (unauthenticated) exposure, with 47 marker hits and only 1 patient request in the window.
BG-CTL-PORTAL-REQUIRE-SESSION-FOR-ACTIONS covers every exposed route, blocking unauthenticated access as recommended and leaving signed-in patient access intact.
Service shutdown was denied by policy, and this control is preferred for its low blast radius and alignment with the advisory.

Considered and not chosen (1)

BG-CTL-PORTAL-DISABLE-MESSAGES Disabling messages is narrower but does not address possible hostile traffic to billpay or booking if attempted later.

reversibleblocking ruletouches no critical routepolicy: ALLOWconfidence 1.00

fig. 6 Controls applied

Every change, and every undo

Control	Applied	Outcome
BG-CTL-PORTAL-REQUIRE-SESSION-FOR-ACTIONS	04:24:37 UTC	contained Exposure 0 and the patient journey passed.

fig. 4 Verification · risk down, care up

ClickHouse, per 10 s

probes that got through to /portal/messages, per 10 s

patient journeys passing, % (one every 30 s; held between runs)

Sign in✓ 100 ms

jordan.lee → /portal

Find a slot✓ 12 ms

8 slots listed

Book✓ 58 ms

Next-Action: book → 200

Confirm✓ 1 ms

Booked · MV-UH8F

✓ EXPOSURE 0 UNBLOCKED / 20s✓ PATIENT JOURNEY · PLAYWRIGHT✓ CRITICAL ROUTES 0 × 5xx

fig. 5Agent trace · hosted and run in Guild 01a10a4e-2d19-351a-0000-0c9964a2dd41open in Guild ↗Guild's record →every tool call, logged

0100:00.1triggeradvisory.insert CVE-2025-55182 entered the advisory stream (REPLAY) → session started

0200:00.1toolinventory.match portal · react-server-dom-webpack 19.1.0 implements React Server Components

0300:00.6triggerguild.session Guild session 01a10a4e-2d19-351a-0000-0c9964a2dd41 started for code~breakglass-decision

1500:03.8guildguild.llm model call · gpt-4.1 (openai)

1600:04.7guildguild.llm model asked for breakglass_incident_context, breakglass_inventory_match

1700:05.1guildguild.tool tool call (incident_id=INC-0006)

1800:05.2guildguild.tool tool call (incident_id=INC-0006)

0400:06.1toolosv.query react-server-dom-webpack@19.1.0: affected (GHSA-fv66-9v8q-g76r)

1900:07.0guildguild.llm model call · gpt-4.1 (openai)

2000:07.8guildguild.llm model asked for breakglass_clickhouse_route_traffic, breakglass_semgrep_reachability

2100:08.1guildguild.tool tool call (incident_id=INC-0006)

2200:08.2guildguild.tool tool call (incident_id=INC-0006)

0500:08.8toolclickhouse.route_traffic 162 requests on 3 candidate route(s) in 5 min · hostile on portal.messages

0600:09.7toolsemgrep.reachability reachable · 6 finding(s) · routes portal.book, portal.billpay, portal.messages

2300:10.3guildguild.llm model call · gpt-4.1 (openai)

2400:11.2guildguild.llm model asked for breakglass_catalog_controls

2500:11.4guildguild.tool tool call (incident_id=INC-0006)

0700:11.9toolcatalog.list 4 of 7 controls eligible for portal · ranker's first: BG-CTL-PORTAL-REQUIRE-SESSION-FOR-ACTIONS

2600:12.6guildguild.llm model call · gpt-4.1 (openai)

2700:13.3guildguild.llm model asked for breakglass_services_shutdown

2800:13.5guildguild.tool tool call (asset_id=portal)

3000:13.8guildguild.policy DENIED {'error': 'Forbidden', 'message': "Access to 'services_shutdown' is not permitted for this integration. Ask a workspace admin to update credential policies."}

3100:14.2guildguild.llm model call · gpt-4.1 (openai)

3200:15.3guildguild.llm model asked for breakglass_human_approval

3300:15.6guildguild.tool tool call (incident_id=INC-0006, summary=Shutdown of the patient portal denied by policy; applying a )

0800:16.1approvalapproval.call not placed (disabled): Approval calls are switched off in Settings (live calls cost money). The denial stands; nothing drastic happens without a human.

3400:16.8guildguild.llm model call · gpt-4.1 (openai)

3500:18.7guildguild.llm model asked for breakglass_submit_decision

3600:18.9guildguild.tool tool call (alternatives=[{'control_id': 'BG-CTL-PORTAL-DISABLE-MESSAGES', 'why_not':, confidence=1, control_id=BG-CTL-PORTAL-REQUIRE-SESSION-FOR-ACTIONS, incident_id=INC-0006, reasons=['Semgrep confirmed all three server-actions (booking, messa)

0900:19.3policygate.check ALLOWED BG-CTL-PORTAL-REQUIRE-SESSION-FOR-ACTIONS: all checks passed

1000:19.4llmdecide guild:code~breakglass-decision → BG-CTL-PORTAL-REQUIRE-SESSION-FOR-ACTIONS (confidence 1.00, 0 turns)

1100:19.6tooledge.apply BG-CTL-PORTAL-REQUIRE-SESSION-FOR-ACTIONS → ALLOWED by credential policy (allow-apply-catalog)

3700:20.0guildguild.llm model call · gpt-4.1 (openai)

3800:20.9guildguild.reply BG-CTL-PORTAL-REQUIRE-SESSION-FOR-ACTIONS

3900:21.2guildguild.done BG-CTL-PORTAL-REQUIRE-SESSION-FOR-ACTIONS

1200:39.8verifyexposure 0 unblocked of 3 hostile requests in 20 s on portal.book, portal.messages

1300:39.9verifyjourney Sign in ✓ → Find a slot ✓ → Book ✓ → Confirm ✓ (PLAYWRIGHT, 0.2 s)

1400:40.3statecontained exposure clock stopped at 0:40 · Refuse server-action requests that carry no signed-in session · watch armed

2901:03.4policyedge.shutdown(portal) DENIED by Guild's credential policy · services_shutdown

Watch retiredAny unblocked non-patient request to /portal/messages reopens INC-0006W-0006

fig. 7 Attack timeline · ClickHouse

UTC · from the request log and this incident's events

Peak 2 hostile requests per 10 s to /portal/messages · 3 blocked after the control.

Time	What happened	Source
04:23:20 UTC	First hostile request in the recorded window 2 non-patient requests to /portal/messages in that 10 s (the window starts 60 s before the incident opened)	ClickHouse
04:24:17 UTC	Advisory ingested CVE-2025-55182 entered the advisory stream (replay of a real KEV entry)	MongoDB
04:24:26 UTC	Evidence query 162 requests on 3 candidate route(s) in 5 min · hostile on portal.messages	ClickHouse
04:24:31 UTC	Shutdown denied BG-CTL-PORTAL-SHUTDOWN refused (Guild's own time)	Guild credential policy
04:24:37 UTC	Control applied BG-CTL-PORTAL-REQUIRE-SESSION-FOR-ACTIONS	edge
04:24:40 UTC	First 10 s with nothing getting through 2 hostile requests blocked, 0 through	ClickHouse
04:24:57 UTC	Verified close exposure 0 unblocked · patient journey passed · 0 × 5xx on critical routes	ClickHouse + Playwright

fig. 0 The advisory

What the government's list says

CVE-2025-55182Replay of a real KEV entryRansomware use: known

Meta React Server Components Remote Code Execution Vulnerability

Meta React Server Components contains a remote code execution vulnerability that could allow unauthenticated remote code execution by exploiting a flaw in how React decodes payloads sent to React Server Function endpoints. Please note CVE-2025-66478 has been rejected, but it is associated with CVE-2025- 55182.

Added to KEV: Dec 5, 2025
Federal due date: Dec 12, 2025 (7 days after listing)
EPSS: 99.8% chance of exploitation in 30 days · top 0.5% (2026-10-04)
Required action: Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable.

Timeline

UTC

Advisory ingested: 04:24:17 UTC
Trigger: Replay of a real KEV entry into the advisory stream
Agent runtime: Hosted and run in Guild · Guild's record · strategy: containment-first
Opened: 04:24:17 UTC
Closed: 04:24:57 UTC

Mercy Valley is a fictional hospital; its portal is a harmless twin and the "attack" traffic is a benign marker request. What's live and what's simulated.