Comment by ajross

The CVE says the that flaw is in React Server Components, which implies strongly that this is a RCE on the backend (!!), not the client.