rsc-security-auditor

🛡️ RSC Security Auditor Detect critical security vulnerabilities CVE-2025-66478, CVE-2025-55184 in your Next.js & React Server Components stack. 🚨 Urgent: Recent disclosures Dec 2025 have revealed critical DoS and RCE vulnerabilities in React Server Components. This tool helps you audit your...

CVE-2025-55182POC

CVE-2025-55182 React Server Components RCE POC This project is a CVE-2025-55182 - React Server Components RSC RCE Proof of Concept , demonstrating remote code execution triggered under specific conditions via vm.runInThisContext and malicious ACTION payload. Python side: Automates sending malicio...

CVE-2025-55182-React2Shell-RCE-POC

CVE-2025-55182 - React2Shell RCE This repository documents research into CVE-2025-55182, also known as React2Shell, a critical unsafe deserialization vulnerability in React Server Components RSC and frameworks that embed the RSC Flight protocol, especially Next.js App Router. The focus here is on...

CVE-2025-55182

CVE-2025-55182 — React2Shell INDEX ABOUT ENVIRONMENT HOW TO USE ABOUT CVE-2025-55182 "React2Shell" is an unauthenticated RCE vulnerability CVSS 10.0 in the Flight protocol deserializer of React Server Components. Vulnerability Overview The reviveModel function in React's Flight protocol client do...

React2Hell

🧨 React2Hell — CVE-2025-55182 Exploit 🔥 Next.js / React Server Remote Code Execution RCE Exploit █████▄ ▄▄▄▄▄ ▄▄▄ ▄▄▄▄ ▄▄▄▄▄▄ ████▄ ██ ██ ▄▄▄▄▄ ▄▄ ▄▄ ██▄▄██▄ ██▄▄ ██▀██ ██▀▀▀ ██ ▄██▀ ██████ ██▄▄ ██ ██ ██ ██ ██▄▄▄ ██▀██ ▀████ ██ ███▄▄ ██ ██ ██▄▄▄ ██▄▄▄ ██▄▄▄ Next.js/React Server RCE Exploit —...

CVE-2025-66478-PoC-Reverse-Shell

CVE-2025-66478 / CVE-2025-55182 "React2Shell" — RSC Server Actions Deserialization RCE PoC Proof-of-concept exploit for CVE-2025-55182 — publicly nicknamed "React2Shell" — a server-side prototype pollution vulnerability in React Server Components' Server Actions deserialization...

react2shell-test-server

React2Shell Test Server A test server for demonstrating and testing React2Shell CVE-2025-55182 vulnerability Description We have been researching the React2Shell RCE CVE-2025-55182 since it was released, and we worked on preventing this vulnerability with our customers. We are open-sourcing this...

CVE-2025-55182

CVE-2025-55182 React2shell exploit CVE-2025-55182+CVE-2025-66478...

vulnerability-in-Remix-React-Router-CVE-2025-31137-

overview after reading write up of @zhero in his personal blogpost i decide to build this CTF to learn how things work and after that i decide to share it with anybody who wants to learn how exploit this vulnerability , i try to make CTF with [email protected] version but when i check...

CVE-2025-55182

CVE-2025-55182 React2Shell Exploit Kit 🎯 Complete Working Exploit Demonstration This project provides a fully functional demonstration of CVE-2025-55182 React2Shell - a critical Remote Code Execution vulnerability in React Server Components and Next.js. Status: ✅ WORKING - Achieves actual command...

React2Shell-CTF

🛡️ React2Shell CTF 🚀 Welcome to React2Shell-CTF , a Dockerized environment designed to practice exploiting React2Shell CVE-2025-55182. React2Shell is a critical vulnerability affecting React-based applications. This repository provides a safe, locally deployable Capture The Flag CTF challenge to...

react2shell-CVE-2025-55182

Attack component contains the attack code. Just uncomment it and press the button to pefrom attach. To run your own code on server exploit simply change the value of prefix key in the payload. See the AttackString file for examples...

next.js-scanner

next.js-scanner Detection scanner for CVE-2025-55182 React Server Component Remote Code Execution Vulnerability...

CVE-2025-55182-React-RSC-Exploit

CVE-2025-55182 // REACT SERVER COMPONENTS RCE OVERVIEW Exploit PoC for CVE-2025-55182. Targets unsafe versions and input validation functions vulnerabilities in React Server Components. TECHNICAL MECHANISM Vector : Prototype pollution via $1:proto :then during hydration. Payload : RCE via...

Blackash-CVE-2025-55182

🚨 CVE-2025-55182 — Critical React Server Vulnerability 🧠 What It Is ⚛️ A critical security flaw in React Server Components RSC 🧨 Caused by unsafe deserialization 🌐 Exploitable via network requests 🔓 No authentication required ☠️ Can lead to Remote Code Execution RCE ✅ This means attackers could...

react2shell-CVE-2025-55182

React2Shell Exploit CVE-2025-55182 Python exploit for Next.js React Server Components RCE vulnerability with HTTP/HTTPS support. 🚀 Quick Start Clone & run git clone https://github.com/BrianLopezM99/react2shell-CVE-2025-55182.git cd react2shell-CVE-2025-55182 python3 exploitreact2shell.py "" 📖 Usa...

CVE-2025-55182

CVE-2025-55182 This repository contains documentation related to the CVE-2025-55182 React2Shell vulnerability The documentation is available: as a website: https://memergamer.github.io/CVE-2025-55182/ as a PDF main.pdf: https://github.com/MemerGamer/CVE-2025-55182/releases...

CVE-2025-55184_Testing

CVE-2025-55184Testing Python script for testing CVE-2025-55184 CVE-2025-55184 – React Server Components DoS Scanner A safe, security validation script designed to detect CVE-2025-55184 , a denial-of-service DoS vulnerability affecting React Server Components RSC. This tool is intended strictly fo...

CVE-2025-55184_CVE-2025-67779

CVE-2025-55184CVE-2025-67779 PoC of CVE-2025-55184 and CVE-2025-67779, which are vulnerabilities of React...

PoC-CVE-2025-55182

PoC: CVE-2026-33017 A pre-authentication remote code execution vulnerability exists in React Server Components versions 19.0.0, 19.1.0, 19.1.1, and 19.2.0 including the following packages: react-server-dom-parcel, react-server-dom-turbopack, and react-server-dom-webpack. The vulnerable code...