CVE-2025-55182-poc

CVE-2025-55182 React Flight protocol vulnerability allowing prototype chain traversal via chunk references. Testing against bullshit-react-project. Detection This is slightly out of date as the real PoC has now been revealed. Vite RSC : bash ./vite-detect.sh https://example.com Next.js : bash...

react2shell

React2Shell CLI tool + Nuclei templates for detecting two critical RCE vulnerabilities in React Server Components and Next.js Server Actions. The scanner was rewritten based on the disclosed react2shell vuln. Vulnerability Overview CVE-2025-55182 – React Server Components Deserialization RCE A fl...

FiberBreak

FiberBreak Exploitation framework for CVE-2025-55182 React2Shell - Critical RCE vulnerability in React Server Components. Overview CVE : CVE-2025-55182 CVSS : 10.0 CRITICAL Type : Remote Code Execution RCE Affected : React 19.0.0-rc.0 to 19.0.0, Next.js 15.0.0 to 15.0.3 Discovery : Lachlan Miller...

react2shell_analyzer

React2Shell Analyzer Un potente analizzatore proxy HTTP per ispezionare il traffico Server Actions di Next.js tra il browser/PoC e il server Next.js. Repository GitHub https://github.com/Benrich127N/react2shellanalyzer.git Caratteristiche 🔍 Ispezione delle intestazioni : Registra tutte le...

React2Shell

React2Shell CVE-2025-55182 Overview This repository is my research on CVE-2025-55182, also referred to as React2Shell vulnerability. Repo consists of two main part: stand and exploit. References Some info about this security flaw: NIST HackerOne article Summary by Vercel Article by WIZ Author...

CVE-2026-23869-Exploit

⚡ CVE-2026-23869 — React2DoS Denial-of-Service remoto non autenticato tramite React Flight Protocol Esaurimento CPU quadratico nella deserializzazione delle Map dei Server Components Panoramica • Come funziona • Strumenti • Installazione • Utilizzo • Nuclei • Correzione • Disclaimer Panoramica...

http-react2shell

React2Shell Nmap Detection Script NSE Detection for CVE-2025-55182 / CVE-2025-66478 – React Server Components / Next.js This repository contains a Nmap Scripting Engine NSE script written in Lua designed to safely detect the critical vulnerability known as React2Shell, affecting React Server...

CVE-2025-55182

CVE-2025-55182 Proof of concept for a Remote Code Execution RCE vulnerability in React Server Functions Next.js, etc.. Exploits prototype pollution to execute arbitrary code on the server without authentication. Warning : This repository is for educational and research purposes only. Unauthorized...

CVE-2025-55182

CVE-2025-55182 React2Shell Analysis Report Sections required by the assignment guidelines are marked with “Required”. 1. Environment Required 1.1. Dockerfile Required This environment uses a custom Dockerfile based on the official Node.js Alpine image. FROM node:20-alpine WORKDIR /app COPY...

CVE-2025-55182

CVE-2025-55182: React Server Components Unsafe Deserialization Vulnerability Overview CVE-2025-55182 also known as React2Shell is a critical unsafe deserialization vulnerability discovered in the React Flight Protocol, affecting the payload of React Server Components RSC. This vulnerability resid...

CVE-2025-55182

CVE-2025-55182 - React Server Components RCE NOTE: Written by AI/Claude https://github.com/ejpir/CVE-2025-55182-bypass TL;DR CVE-2025-55182 is a critical RCE vulnerability in React's Flight Protocol. The attack chains path traversal + fake chunk injection + $B handler abuse to execute...

CVE-2025-55182

CVE-2025-55182 Original author:https://github.com/msanft/CVE-2025-55182 This vulnerability allows RCE in React Server Functions, e.g. as offered by Next.js through insecure prototype references. I'm not an expert in React or Next.js, so take all the information here with a grain of salt. Backgrou...

nextjs-CVE-2025-55182

CVE-2025-55182 / CVE-2025-66478 React2Shell - Next.js Remote Code Execution RCE PoC Critical vulnerability in Next.js Server Actions allowing unauthenticated Remote Code Execution via React Flight Protocol deserialization Overview This repository contains a Proof of Concept PoC for the critical R...

react2shell-CVE-2025-55182-full-rce-script

Strumento di Exploit per Next.js React2Shell CVE-2025-55182 Uno strumento proof-of-concept per dimostrare la vulnerabilità critica React2Shell CVE-2025-55182 / CVE-2025-66478 esclusivamente su ambienti di test locali autorizzati. ⚠️ AVVERTENZA CRITICA: SFRUTTAMENTO ATTIVO Questa vulnerabilità CVSS...

Exploit for Deserialization of Untrusted Data in Facebook React

CVE-2025-55182 — "Ghost Action" React2Shell React Server Co...

CVE-2025-55182

CVE-2025-55182 — React2Shell Esecuzione remota di codice RCE pre-autenticazione in React Server Components RSC, Next.js e framework correlati. Panoramica CVE-2025-55182 nota anche come React2Shell è una vulnerabilità critica di RCE pre-autenticazione che colpisce l'ecosistema React Server...

Exploit for Deserialization of Untrusted Data in Facebook React

CVE-2025-55182 React2Shell Analysis Report Sections require...

Exploit for CVE-2026-23869

⚡ CVE-2026-23869 — React2DoS Unauthenticated Remote Denial-o...

Exploit for Deserialization of Untrusted Data in Facebook React

React-2025 CTF Lab: CVE-2025-55182 Overview This repositor...

Allocation of Resources Without Limits or Throttling

Overview @modern-js/utils is a progressive web framework based on React. Affected versions of this package are vulnerable to Allocation of Resources Without Limits or Throttling in the decoding reply functions of React Flight protocol. An attacker can cause server crashes, out-of-memory exception...