Exploit for CVE-2025-55182

React2Shell Vulnerable Banking Application Lab Deliberately v...

Exploit for CVE-2025-55182

CVE-2025-55182 React2Shell Detection Tool Detection tools for...

Wallarm Halts Remote Code Execution Exploits: Defense for Vulnerable React Server Component Workflows

On December 3, 2025, React maintainers disclosed a critical unauthenticated remote code execution RCE vulnerability in React Server Components RSC, tracked as CVE-2025-55182. A working PoC was released publicly, and Wallarm immediately began observing widespread exploitation attempts across...

Exploit for CVE-2025-55182

what's it For CVE-2025-55182 and CVE-2025-66478 Security Resp...

Exploit for CVE-2025-55182

CVE-2025-55182 / CVE-2025-66478 Vulnerability Scanner React...

Exploit for CVE-2025-55182

CVE-2025-55182 and CVE-2025-66478 Technical Analysis of Ar...

Exploit for CVE-2025-55182

CVE-2025-55182 - React Server Components RCE Exploit Python C...

47th (0.1.0), @0xchain/auth (>=0.0.1, <=1.1.0-beta.7) +178 more potentially affected by CVE-2025-71389 via next (>=15.5.0, <=15.5.6)

next NPM version =15.5.0, =0.0.1, =0.0.1, =0.0.1, =0.0.1, =0.0.1, =0.0.1, =0.0.1, =0.0.1, =0.0.1, =0.0.1, =0.0.1, =0.0.1, =0.0.1, =0.0.1, =1.1.0-beta.7 and more Source cves: CVE-2025-71389 Source advisory: OSV:GHSA-9QR9-H5GF-34MP...

3llm (0.0.1), @3bitmt/3bit-sidebar-dashboard (1.1.4) +299 more potentially affected by CVE-2025-71389 via next (>=15.1.0, <=15.1.8)

next NPM version =15.1.0, =0.0.3-alpha-20241210234548-01b7322d940b7c913e95222127be2373f0f996cf, =0.0.4, =0.0.4, =0.0.4, =0.0.4, =0.0.4, =0.0.4, =0.0.4, =0.0.1, =0.1.1, =0.1.0, =0.1.22 and more Source cves: CVE-2025-71389 Source advisory: OSV:GHSA-9QR9-H5GF-34MP...

-shaz-react-rich-text-editor (>=0.1.0, <=0.1.1), 0xmugitea (0.1.0) +294 more potentially affected by CVE-2025-71389 via next (>=15.3.0, <=15.3.5)

next NPM version =15.3.0, =0.1.0, =0.1.0, =0.1.12, =0.1.0, =0.1.0, =0.0.5-alpha-20250409222818-a35bb677fde1e4e9cf3db443e9ae36abf4f8e21b, =0.0.20, =0.0.22 - @aeon-ai-pay/x402-axios 0.0.1 - @aeon-ai-pay/x402-hono 0.0.3 - @affrawidy/wawok 1.1.4 - @agogic/business-data 0.0.2 and more Source cves:...

@071yoon/log-console-core (0.1.0), @adarshanatia/init-web (>=1.0.0, <=1.0.1) +122 more potentially affected by CVE-2025-71389 via next (>=16.0.0, <=16.0.6)

next NPM version =16.0.0, =1.0.0, =0.3.128, =0.9.58-canary.1, =0.9.58-canary.1, =0.9.58-canary.1, =0.9.58-canary.1, =0.9.58-canary.1, =1.0.4186, =0.1.0, =1.0.0, =0.1.0, =0.0.152, =0.1.33, =1.7.4, =1.9.5 and more Source cves: CVE-2025-71389 Source advisory: OSV:GHSA-9QR9-H5GF-34MP...

@aandyw/ybf (>=0.1.0, <=0.1.29), @accounter/client (>=0.0.4-alpha-20250227014300-bbaee6f285ce9d54b581b115d444233911983665, <=0.0.5-alpha-20250410150030-25fea893fb3523b55c835620f6692430d5bc9bee) +210 more potentially affected by CVE-2025-71389 via next (>=15.2.0, <=15.2.5)

next NPM version =15.2.0, =0.1.0, =0.0.4-alpha-20250227014300-bbaee6f285ce9d54b581b115d444233911983665, =0.0.1-alpha, =0.1.0, =3.2.0, =0.1.0, =1.1.0-canary.0, =1.1.0-canary.0, =1.2.0-canary.0, =1.2.2-canary-20250514183211, =1.2.0-canary.8, =1.6.0 and more Source cves: CVE-2025-71389 Source...

DRUPAL-CONTRIB-2025-122

This module enables integration between Next.js and Drupal for headless CMS functionality. When installed, the module automatically enables cross-origin resource sharing CORS with insecure default settings Access-Control-Allow-Origin: , overriding any services.yml CORS configuration. This allows...

Critical RSC Bugs in React and Next.js Allow Unauthenticated Remote Code Execution

A maximum-severity security flaw has been disclosed in React Server Components RSC that, if successfully exploited, could result in remote code execution. The vulnerability, tracked as CVE-2025-55182, carries a CVSS score of 10.0. The vulnerability has been codenamed React2shell. It allows...

3llm (0.0.1), @3bitmt/3bit-sidebar-dashboard (1.1.4) +299 more potentially affected by CVE-2025-55182 +1 more via next (>=15.1.0, <=15.1.8)

next NPM version =15.1.0, =0.0.3-alpha-20241210234548-01b7322d940b7c913e95222127be2373f0f996cf, =0.0.4, =0.0.4, =0.0.4, =0.0.4, =0.0.4, =0.0.4, =0.0.4, =0.0.1, =0.1.1, =0.1.0, =0.1.22 and more Source cves: CVE-2025-55182, CVE-2025-66478 Source advisory: SNYK:JS-NEXT-14173355...

@aandyw/ybf (>=0.1.0, <=0.1.29), @accounter/client (>=0.0.4-alpha-20250227014300-bbaee6f285ce9d54b581b115d444233911983665, <=0.0.5-alpha-20250410150030-25fea893fb3523b55c835620f6692430d5bc9bee) +210 more potentially affected by CVE-2025-55182 +1 more via next (>=15.2.0, <=15.2.5)

next NPM version =15.2.0, =0.1.0, =0.0.4-alpha-20250227014300-bbaee6f285ce9d54b581b115d444233911983665, =0.0.1-alpha, =0.1.0, =3.2.0, =0.1.0, =1.1.0-canary.0, =1.1.0-canary.0, =1.2.0-canary.0, =1.2.2-canary-20250514183211, =1.2.0-canary.8, =1.6.0 and more Source cves: CVE-2025-55182, CVE-2025-664...

@071yoon/log-console-core (0.1.0), @adarshanatia/init-web (>=1.0.0, <=1.0.1) +122 more potentially affected by CVE-2025-55182 +1 more via next (>=16.0.0, <=16.0.6)

next NPM version =16.0.0, =1.0.0, =0.3.128, =0.9.58-canary.1, =0.9.58-canary.1, =0.9.58-canary.1, =0.9.58-canary.1, =0.9.58-canary.1, =1.0.4186, =0.1.0, =1.0.0, =0.1.0, =0.0.152, =0.1.33, =1.7.4, =1.9.5 and more Source cves: CVE-2025-55182, CVE-2025-66478 Source advisory: SNYK:JS-NEXT-14173355...

47th (0.1.0), @0xchain/auth (>=0.0.1, <=1.1.0-beta.7) +178 more potentially affected by CVE-2025-55182 +1 more via next (>=15.5.0, <=15.5.6)

next NPM version =15.5.0, =0.0.1, =0.0.1, =0.0.1, =0.0.1, =0.0.1, =0.0.1, =0.0.1, =0.0.1, =0.0.1, =0.0.1, =0.0.1, =0.0.1, =0.0.1, =0.0.1, =1.1.0-beta.7 and more Source cves: CVE-2025-55182, CVE-2025-66478 Source advisory: SNYK:JS-NEXT-14173355...

-shaz-react-rich-text-editor (>=0.1.0, <=0.1.1), 0xmugitea (0.1.0) +294 more potentially affected by CVE-2025-55182 +1 more via next (>=15.3.0, <=15.3.5)

next NPM version =15.3.0, =0.1.0, =0.1.0, =0.1.12, =0.1.0, =0.1.0, =0.0.5-alpha-20250409222818-a35bb677fde1e4e9cf3db443e9ae36abf4f8e21b, =0.0.20, =0.0.22 - @aeon-ai-pay/x402-axios 0.0.1 - @aeon-ai-pay/x402-hono 0.0.3 - @affrawidy/wawok 1.1.4 - @agogic/business-data 0.0.2 and more Source cves:...

@adenta/cms (>=0.0.6, <=1.1.1-0), @alisonquinter17/alieta-ui (0.1.0) +122 more potentially affected by CVE-2025-55182 +1 more via next (>=15.4.0-canary.17, <=15.4.7)

next NPM version =15.4.0-canary.17, =0.0.6, =1.2.4-main.7f918ee.29, =1.0.0, =1.0.0-beta.3, =1.0.2, =0.0.1, =0.0.4, =0.0.1, =1.1.0, =0.1.3, =0.1.1, =0.1.7, =0.1.8 and more Source cves: CVE-2025-55182, CVE-2025-66478 Source advisory: SNYK:JS-NEXT-14173355...