CVE-2025-55182

CVE-2025-55182 React2Shell Exploit Kit 🎯 Complete Working Exploit Demonstration This project provides a fully functional demonstration of CVE-2025-55182 React2Shell - a critical Remote Code Execution vulnerability in React Server Components and Next.js. Status: ✅ WORKING - Achieves actual command...

CVE-2025-55182

CVE-2025-55182 — React2Shell Pre-authentication Remote Code Execution in React Server Components RSC, Next.js, and related frameworks. Overview CVE-2025-55182 also referred to as React2Shell is a critical pre-authentication RCE vulnerability affecting the React Server Components RSC ecosystem. An...

react2shell-lab

React2Shell - CVE-2025-55182 Lab A comprehensive laboratory for demonstrating and testing the critical vulnerability CVE-2025-55182 in React Server Components. ⚠️ Educational Purpose Only This repository is intended for: Security research and education Understanding vulnerability mechanisms Testin...

CVE-2025-55182-React-RSC-Exploit

CVE-2025-55182 // REACT SERVER COMPONENTS RCE OVERVIEW Exploit PoC for CVE-2025-55182. Targets unsafe versions and input validation functions vulnerabilities in React Server Components. TECHNICAL MECHANISM Vector : Prototype pollution via $1:proto :then during hydration. Payload : RCE via...

react2shell-scanner

react2shell-scanner React Server Componentsを使用するNext.jsアプリケーションにおけるCVE-2025-55182およびCVE-2025-66478を検出するためのコマンドラインツールです。 脆弱性と検出方法の技術的詳細については、ブログ記事を参照してください: https://slcyber.io/research-center/high-fidelity-detection-mechanism-for-rsc-next-js-rce-cve-2025-55182-cve-2025-66478 仕組み...

cve-2025-55182-poc

Basic Information CVE-2025-55182 is one of the most impactful Web framework vulnerabilities of 2025. React Server Components RSC are now the mainstream architecture for modern Next.js applications, and a large number of standard projects created with create-next-app are within the affected scope,...

vulnerable-next-js-poc

CVE-2025-55182 React2Shell - Proof of Concept ⚠️ SECURITY RESEARCH ONLY This repository contains a proof of concept for CVE-2025-55182 , a critical remote code execution vulnerability in React Server Components. This is for authorized security testing and research purposes only. Vulnerability...

CVE-2025-55182-Next.js-RCE

🔍 Next.js Security Testing Tool Professional security assessment utility for Next.js applications ⚠️ Disclaimer This tool is intended for authorized security testing and research purposes only. ✅ Use only on systems you own or have explicit permission to test ✅ For bug bounty programs with proper...

react2shell-ultimate

React2Shell Ultimate Scanner v2.0 CVE-2025-66478 対応のプロフェッショナル Next.js RSC RCE 脆弱性スキャナー 🎯 概要 React2Shell Ultimate は、CVE-2025-66478 - React Server Components RSC を使用する Next.js アプリケーションに影響を与える重大なリモートコード実行 RCE 脆弱性 - 向けの包括的な脆弱性スキャナーです。 🆕 v2.0 の新機能 バージョン 2.0 では、大幅な機能強化とプロフェッショナル向け機能が追加されています: ✨ 強化された G...

Damn-Vulnerable-Android-Components

The Damne Vulnerable Android Components - DVAC The sieve reborn! Damn Vulnerable Android Components DVAC is an educational Android application intentionally designed to expose and demonstrate vulnerabilities related to various Android components such as Activities, Intents, Content Providers, and...

CVE-2025-55182

CVE-2025-55182 — React2Shell INDEX ABOUT ENVIRONMENT HOW TO USE ABOUT CVE-2025-55182 "React2Shell" is an unauthenticated RCE vulnerability CVSS 10.0 in the Flight protocol deserializer of React Server Components. Vulnerability Overview The reviveModel function in React's Flight protocol client do...

jshole

jshole A simple JavaScript components vulnrability scanner, based on RetireJS. Why use JShole instead of RetireJS? By default, RetireJS only searches one page, but JShole tries to crawl all pages. Get Started Requirements requests Install git clone https://github.com/callforpapers-source/jshole.g...

CVE-2025-55182POC

CVE-2025-55182 React Server Components RCE POC This project is a CVE-2025-55182 - React Server Components RSC RCE Proof of Concept , demonstrating remote code execution triggered under specific conditions via vm.runInThisContext and malicious ACTION payload. Python side: Automates sending malicio...

CVE-2025-55184_Testing

CVE-2025-55184Testing Python script for testing CVE-2025-55184 CVE-2025-55184 – React Server Components DoS Scanner A safe, security validation script designed to detect CVE-2025-55184 , a denial-of-service DoS vulnerability affecting React Server Components RSC. This tool is intended strictly fo...

POC_react2shell_CVE-2025-55182

Next.js React Server Components RCE Exploit Exploits CVE-2025-55182 for remote code execution via prototype pollution. Author: Severian N.K. Description This tool exploits a prototype pollution vulnerability in Next.js applications using React Server Components, leading to Remote Code Execution...

Next.js_exploit_CVE-2024-34351

csr-rsc-ssg-isr-ssr-ssrf This repo can be used as support to present one or more meetups. The path is as follows... "CSR" Client Side Rendering: React as a standard SPA library "RSC" React Server Components: execution of React components only on the server side "SSG" Static Site Generation:...

react2shellpoc

このリポジトリには、特定のクラスのReact Server Component脆弱性が管理された合法的なトレーニング環境 内でどのように動作するかを示す概念実証（PoC）が含まれています。 マニュアル ┌──kali㉿kali-/Documents/tools/2025-55182 └─$ python exploit.py -h /\ /\ /\ /\ /\ /\ || CVE-2025-55182 React Server Components RCE usage: exploit.py -h -t URL -c CMD options: -h, --help show this...

Software-Component-Verification-Standard

OWASP Software Component Verification Standard The Software Component Verification Standard SCVS is a community-driven effort to establish a framework for identifying activities, controls, and best practices, which can help in identifying and reducing risk in a software supply chain. Managing ris...

CVE-2025-55182

CVE-2025-55182 React Server Components Remote Code Execution CVE-2025-55182 and Next.js Remote Code Execution CVE-2025-66478. This vulnerability primarily affects the Server Actions functionality in react-server-dom-webpack. Due to missing security validation when parsing client-submitted forms, ...

PoC-CVE-2025-55182

PoC: CVE-2026-33017 A pre-authentication remote code execution vulnerability exists in React Server Components versions 19.0.0, 19.1.0, 19.1.1, and 19.2.0 including the following packages: react-server-dom-parcel, react-server-dom-turbopack, and react-server-dom-webpack. The vulnerable code...