CVE-2025-55182-React2Shell-CVSS-10.0-

영향을 받는 소프트웨어: React Server Components 버전 19.0.0, 19.1.0, 19.1.1, 19.2.0 취약점 유형: 안전하지 않은 역직렬화를 통한 사전 인증 원격 코드 실행 설명: React Server Flight 프로토콜의 결함으로 인해 인증되지 않은 공격자가 특수하게 조작된 직렬화된 페이로드를 전송하여 프로토타입 오염을 악용하고, 서버에서 임의 코드 실행을 유발할 수 있습니다. 또한 참고용으로 exploit.py Python PoC와 동료 플레이어를 위한 HTB 친화적인 버전을 포함했습니다...

CVE-2025-55182

CVE-2025-55182 스캐너 CVE-2025-55182 에 대한 개념 증명 스캐너로, React Server ComponentsRSC의 중요한 인증되지 않은 원격 코드 실행RCE 취약점입니다. 개요 2025년 12월 3일, React Server Components를 사용하는 React 19.x 및 Next.js 애플리케이션에 영향을 미치는 중요한 취약점이 공개되었습니다. 이 결함은 RSC "Flight" 프로토콜의 역직렬화 로직에 존재하며, 공격자가 조작된 HTTP 요청을 통해 서버에서 임의의 코드를 실행할 수 있게...

react2shell

React2Shell React Server Components 및 Next.js Server Actions에서 두 가지 치명적인 RCE 취약점을 탐지하기 위한 CLI 도구 및 Nuclei 템플릿입니다. 스캐너는 공개된 react2shell 취약점을 기반으로 재작성되었습니다. 취약점 개요 CVE-2025-55182 – React Server Components 역직렬화 RCE React Flight 역직렬화 프로세스의 결함으로 인해 사용자가 제어하는 참조가 서버 함수로 해석될 수 있으며, 이로 인해 원격 코드 실행이 발생할 수...

CVE-2025-55182-analysis

1. 취약점 개요 최근 React의 역직렬화 RCE 취약점이 이슈가 되고 있습니다. 공식 CVSS는 10.0점으로, 당시 Log4j와 동일한 수준입니다. 한때 많은 소문이 현대 프론트엔드의 Log4j라고 불리며 많은 회사 개발자들의 공포를 불러일으켰고, 모두가 일어나자마자 다양한 문헌을 찾아보고 패치를 적용하기 시작했습니다... 동시에 온라인에서는 많은 의문이 제기되었으며, 일부 테스트 결과 이 취약점이 알려진 것만큼 심각하지 않고 오히려 특정 조건이 필요하다는 것이 밝혀졌습니다. 그래서 저는 시간을 내어 이 취약점을 깊이...

CVE-2025-55182

CVE-2025-55182 - React2Shell React Server Components / Next.js 사전 인증 원격 코드 실행 속성| 값 ---|--- CVE ID| CVE-2025-55182 CVSS| 10.0 Critical CWE| CWE-502: Deserialization of Untrusted Data 유형| Pre-Auth RCE 영향을 받는 범위 구성 요소| 영향을 받는 버전 ---|--- React| 19.0.0, 19.1.0, 19.1.1, 19.2.0 Next.js| 15.0.0 15.0.4,...

CVE-2026-100609

Flowise npm packages flowise and flowise-components through 3.1.4 looks up credentials by ID without filtering on the requesting user's workspace findOneBy id: credentialId with no workspaceId condition in several code paths: getAllOpenaiAssistants/getSingleOpenaiAssistant GET...

EUVD-2026-87704

Flowise npm packages flowise and flowise-components through 3.1.4 looks up credentials by ID without filtering on the requesting user's workspace findOneBy id: credentialId with no workspaceId condition in several code paths: getAllOpenaiAssistants/getSingleOpenaiAssistant GET...

CVE-2026-100609

The Flowise npm packages (flowise and flowise-components) versions through 3.1.4 are vulnerable to an Insecure Direct Object Reference (IDOR) . The software fails to filter credential lookups by the requesting user's workspaceId when querying by ID. This flaw affects several code paths, including...

CVE-2026-100609 Flowise through 3.1.4 Insecure Direct Object Reference via Credential

Flowise npm packages flowise and flowise-components through 3.1.4 looks up credentials by ID without filtering on the requesting user's workspace findOneBy id: credentialId with no workspaceId condition in several code paths: getAllOpenaiAssistants/getSingleOpenaiAssistant GET...

CVE-2026-100609: Authorization Bypass Through User-Controlled Key

Flowise npm packages flowise and flowise-components through 3.1.4 looks up credentials by ID without filtering on the requesting user's workspace findOneBy id: credentialId with no workspaceId condition in several code paths: getAllOpenaiAssistants/getSingleOpenaiAssistant GET...

React Server Components - Remote Code Execution

React Server Components 19.0.0, 19.1.0, 19.1.1, and 19.2.0 including react-server-dom-parcel, react-server-dom-turbopack, and react-server-dom-webpack contain a remote code execution caused by unsafe deserialization of payloads from HTTP requests to Server Function endpoints, letting...

Home Assistant: XSS in Statistics Graph Card

Summary An authenticated party can add a malicious name to any statistics-capable entity, allowing for Cross-Site Scripting attacks against anyone who views a Statistics Graph card containing that entity, when they hover over any data point on the chart. Payload Payload triggering An alternative,...

GHSA-4GHV-53CQ-7WP3 Home Assistant: mDNS Server-Side Request Forgery

Summary Home Assistant Green is vulnerable to a Server-Side Request Forgery SSRF via the mDNS/Zeroconf IPP integration. An unauthenticated attacker on the local network can send a crafted mDNS response to trick Home Assistant into making HTTP requests to arbitrary hosts, including internal servic...

CVE-2026-91130

Home Assistant is open source home automation software focused on local control and privacy. Prior to 2026.7.0, the Statistics Graph card in src/components/chart/statistics-chart.ts passed entity names through getStatisticLabel and computeStateName and interpolated param.seriesName into ECharts...

CVE-2026-91130 Home Assistant: XSS in Statistics Graph Card

Home Assistant is open source home automation software focused on local control and privacy. Prior to 2026.7.0, the Statistics Graph card in src/components/chart/statistics-chart.ts passed entity names through getStatisticLabel and computeStateName and interpolated param.seriesName into ECharts...

CVE-2026-91130 Home Assistant: XSS in Statistics Graph Card

Home Assistant is open source home automation software focused on local control and privacy. Prior to 2026.7.0, the Statistics Graph card in src/components/chart/statistics-chart.ts passed entity names through getStatisticLabel and computeStateName and interpolated param.seriesName into ECharts...

EUVD-2026-84803

Home Assistant is open source home automation software focused on local control and privacy. Prior to 2026.7.0, the Statistics Graph card in src/components/chart/statistics-chart.ts passed entity names through getStatisticLabel and computeStateName and interpolated param.seriesName into ECharts...

CVE-2026-91130

Prior to version 2026.7.0 , the Statistics Graph card in Home Assistant (specifically in src/components/chart/statistics-chart.ts) was vulnerable to Cross-Site Scripting (XSS) . The application failed to escape entity names passed through getStatisticLabel and computeStateName, as well as interpo...

CVE-2026-91130 Home Assistant: XSS in Statistics Graph Card

Home Assistant is open source home automation software focused on local control and privacy. Prior to 2026.7.0, the Statistics Graph card in src/components/chart/statistics-chart.ts passed entity names through getStatisticLabel and computeStateName and interpolated param.seriesName into ECharts...

CVE-2026-86062

LightRAG provides simple and fast retrieval-augmented generation. Prior to 1.5.5, lightragwebui/src/components/retrieval/ChatMessage.tsx renders answer and thinking content with react-markdown, rehypeRaw, and skipHtml=false without an HTML sanitizer. An attacker who can add a document can store r...