CVE-2025-55182-poc

CVE-2025-55182 React Flight 协议漏洞，允许通过块引用进行原型链遍历。针对 bullshit-react-project 进行测试。 检测 以下内容略有过时，因为实际 PoC 现已公开。 Vite RSC ：bash ./vite-detect.sh https://example.com Next.js ：bash ./nextjs-detect.sh https://example.com 或者同时检测两者，只需运行 bash ./detect.sh https://example.com 两个脚本都接受可选的超时参数（Vite 默认 3 秒，Next.js...

PT-2025-51776

@vitejs/plugin-rs provides React Server Components RSC support for Vite. Prior to version 0.5.8, the / vite rsc findSourceMapURL endpoint in @vitejs/plugin-rsc allows unauthenticated arbitrary file read during development mode. An attacker can read any file accessible to the Node.js process by...