Executive brief
This advisory has been withdrawn. LikeC4 is an architecture visualization tool that was initially reported to be vulnerable to remote code execution through transitive dependencies in React and Next.js. The advisory was retracted because LikeC4 does not ship React as a direct dependency; React is only a peer dependency managed by end users, placing vulnerability remediation responsibility outside the scope of LikeC4's releases.
Technical details
This advisory was withdrawn by the maintainers after review. The original report claimed LikeC4 was vulnerable to CVE-2025-55182 (an RCE in React Server Components) through dependencies on React and Next.js. However, investigation revealed that React is a peer dependency rather than a direct bundled dependency in LikeC4, meaning consumers are responsible for providing and patching their own React installation. The underlying React/Next.js vulnerabilities remain real for projects that depend on affected React versions (19.0.0–19.2.0 in react-server-dom packages), but LikeC4 itself does not require a security release for this issue.
Affected products
- LikeC4 likec4 1.46.1 and earlier (advisory withdrawn)
Timeline
- 2025-12-15: disclosed: Advisory published for LikeC4 reporting RCE vulnerability through React/Next.js peer dependencies
- 2025-12-22: other: Advisory withdrawn - determined that LikeC4 is not directly impacted because React is a peer dependency, not a shipped dependency