react2shell

React2Shell React Server Components / Server Actions におけるプロトタイプ汚染の脆弱性を悪用し、脆弱なサーバー上でリモートコード実行（RCE）を可能にするCLIツールです（CVE-2025-55182 & CVE-2025-66478）。 オリジナルPoC : https://github.com/lachlan2k/React2Shell-CVE-2025-55182-original-poc 警告: このツールは現在実際に悪用されている深刻な脆弱性（CVSS 10.0）を標的としています。...

snyk-js-jquery-174006

此仓库包含了针对 CVE-2019-11358 - 原型污染漏洞 的补丁，该漏洞影响所有早于 3.4.0 的 jQuery 版本。 这些补丁通过 diff -u original patched patchfile 命令生成。 应用补丁 你可以通过 patch、git apply、patch-package 和 composer-patches 来应用这些补丁。 请查阅相应的文档。 生成压缩版本 你可以先将补丁应用到原始的非压缩版本上，然后在终端中运行 ./minify.sh（需要 Node.js）来生成压缩版本。 支持 仅通过 Threema...

axios: Axios: Man-in-the-Middle (MITM) attack via Prototype Pollution

A flaw was found in Axios. This vulnerability, a Prototype Pollution "Gadget" attack, allows an attacker to escalate any existing Object.prototype pollution in an application's dependency tree into a full Man-in-the-Middle MITM attack. This enables the attacker to intercept, read, and modify all...

axios: Axios: Prototype pollution allows information disclosure and request manipulation

A flaw was found in Axios, a widely used HTTP client. This vulnerability, known as prototype pollution, allows an attacker to inject malicious properties into core JavaScript objects. When another component in the same application environment is compromised and pollutes the system's object...

axios: Axios: Information disclosure due to prototype pollution vulnerability

A flaw was found in Axios, a promise-based HTTP client. This vulnerability involves prototype pollution gadgets in the request configuration processing. If another vulnerability has already polluted the Object.prototype.transformResponse, affected Axios versions may incorrectly interpret this...

Important: Red Hat Security Advisory: Red Hat AMQ Broker 7.13.6 release and security update

Red Hat AMQ Broker 7.13.6 is now available from the Red Hat Customer Portal. Red Hat Product Security has rated this update as having a security impact of Important. A Common Vulnerability Scoring System CVSS base score, which gives a detailed severity rating, is available for each vulnerability...

EXPLOIT-CVE-2025-55182

CVE-2025-55182 概念验证 概述 针对 CVE-2025-55182 React2Shell 的实践演示——React Server Components 中的一个严重 RCE 漏洞。 漏洞详情 CVE 编号 : CVE-2025-55182 类型 : 通过原型污染实现的远程代码执行 CVSS : 9.8 严重 影响范围 : React 19.0.0, 19.1.0, 19.1.1, 19.2.0 攻击向量 React Server Components 不安全地反序列化 FormData。特制的多部分字段会触发原型污染，并通过 childprocess.execSync...

NPM: n8n: Prototype Pollution via Workflow Structure Summary Can Lead to Denial of Service

NPM: n8n: Prototype Pollution via Workflow Structure Summary Can Lead to Denial of Service vulnerability discovered by ? in WordPress Npm n8n versions 2.37.7...

EUVD-2026-74278

n8n: Prototype Pollution via Workflow Structure Summary Can Lead to Denial of Service...

n8n: Prototype Pollution via Workflow Structure Summary Can Lead to Denial of Service

Impact The Instance AI workflow summary built its result with get-or-create-then-nested-write idioms keyed by node names and connection keys taken from the stored workflow. Those are arbitrary strings: the restricted-name guard n8n shows in the editor is client-side and is bypassed by posting the...

CVE-2026-89011

isomorphic-git before 1.42.0 contains a prototype pollution vulnerability in the getRemoteInfo function that allows a malicious Git server operator to pollute Object.prototype by advertising crafted ref names containing 'proto' path segments during ref negotiation. Attackers controlling a Git...

CVE-2025-55182-poc

CVE-2025-55182-poc 一个针对 CVE-2025-55182 的概念验证（PoC）漏洞利用程序，目标是 Next.js Server Actions 中的未认证远程代码执行（RCE）漏洞。 该漏洞利用程序滥用 React Server Components（RSC）multipart 负载反序列化过程中的原型污染，通过异步、非阻塞的执行流程将恶意命令注入 Node.js 进程。 功能特性 异步执行 ：使用 childprocess.exec 而非阻塞式的 execSync API，以防止容器节点上的线程挂起。 稳健的多 Shell 投递 ：利用符合 POSIX 标准的...

CVE-2026-89011

A flaw was found in isomorphic-git. This prototype pollution vulnerability in the getRemoteInfo function allows a malicious Git server operator to manipulate object properties by advertising specially crafted reference names. This can reroute network operations through an attacker-controlled prox...

CVE-2026-89011

isomorphic-git before 1.42.0 is affected by a prototype pollution vulnerability in the getRemoteInfo function. A malicious Git server can advertise crafted ref names containing __proto__ path segments during ref negotiation (e.g., __proto__/corsProxy), polluting Object.prototype to reroute all su...

CVE-2026-89011 isomorphic-git < 1.42.0 Prototype Pollution via getRemoteInfo

isomorphic-git before 1.42.0 contains a prototype pollution vulnerability in the getRemoteInfo function that allows a malicious Git server operator to pollute Object.prototype by advertising crafted ref names containing 'proto' path segments during ref negotiation. Attackers controlling a Git...

CVE-2026-89011 isomorphic-git < 1.42.0 Prototype Pollution via getRemoteInfo

isomorphic-git before 1.42.0 contains a prototype pollution vulnerability in the getRemoteInfo function that allows a malicious Git server operator to pollute Object.prototype by advertising crafted ref names containing 'proto' path segments during ref negotiation. Attackers controlling a Git...

axios: Axios: Man-in-the-Middle (MITM) attack via Prototype Pollution

A flaw was found in Axios. This vulnerability, a Prototype Pollution "Gadget" attack, allows an attacker to escalate any existing Object.prototype pollution in an application's dependency tree into a full Man-in-the-Middle MITM attack. This enables the attacker to intercept, read, and modify all...

Important: Red Hat Security Advisory: Red Hat AMQ Broker 7.14.1 release and security update

Red Hat AMQ Broker 7.14.1 is now available from the Red Hat Customer Portal. Red Hat Product Security has rated this update as having a security impact of Important. A Common Vulnerability Scoring System CVSS base score, which gives a detailed severity rating, is available for each vulnerability...

axios: Axios: Prototype pollution allows information disclosure and request manipulation

A flaw was found in Axios, a widely used HTTP client. This vulnerability, known as prototype pollution, allows an attacker to inject malicious properties into core JavaScript objects. When another component in the same application environment is compromised and pollutes the system's object...

CVE-2026-40175

🚨 CVE-2026-40175 - Axios 中的严重漏洞 原型污染 Gadget → 远程代码执行与云环境沦陷 📢 概述 Axios —— 最流行的 JavaScript HTTP 客户端之一（支持浏览器和 Node.js）—— 在 1.15.0 版本之前存在一个 严重 漏洞。 一条特定的 “gadget” 攻击链 允许攻击者将 任意原型污染 （即使来自第三方依赖）升级为： 远程代码执行（RCE） 完全攻陷云环境 （包括绕过 AWS IMDSv2 窃取凭证） CVSS 评分： 10.0（严重） 攻击向量： 网络 攻击复杂度： 低 所需权限： 无 用户交互： 无 🛡️ 修复版本 ✅...