Critical vulnerability in React library should be treated by IT as they did Log4j - as an emergency, warns one expert.