CVE-2025-66478-PoC-Reverse-Shell

CVE-2025-66478 / CVE-2025-55182 "React2Shell" — RSC Server Actions Deserialization RCE PoC Proof-of-concept exploit for CVE-2025-55182 — publicly nicknamed "React2Shell" — a server-side prototype pollution vulnerability in React Server Components' Server Actions deserialization...

cve-2025-55182-poc

CVE-2025-55182 React2Shell Vulnerability Analysis Lab This repository contains a complete environment for analyzing and reproducing CVE-2025-55182 , a critical Remote Code Execution RCE vulnerability in React Server Components RSC affecting React 19.x and Next.js 15.x. ⚠️ WARNING: This project...

cve-2025-55182-react2shell-analysis

CVE-2025-55182 React2Shell — Security Analysis Overview This project is a technical analysis of CVE-2025-55182, a critical Remote Code Execution RCE vulnerability disclosed in December 2025. The vulnerability affects React Server Components and allows attackers to execute arbitrary code via...

react2shell-CVE-2025-55182

React2Shell Exploit CVE-2025-55182 Python exploit for Next.js React Server Components RCE vulnerability with HTTP/HTTPS support. 🚀 Quick Start Clone & run git clone https://github.com/BrianLopezM99/react2shell-CVE-2025-55182.git cd react2shell-CVE-2025-55182 python3 exploitreact2shell.py "" 📖 Usa...

cve-2025-55182-analysis

CVE-2025-55182 — React Server Components RCE Analysis Web application vulnerability analysis · M2 Cybersecurity · 2025 Author: Niane Mohamed · LinkedIn End-to-end exploitation chain of a critical CVSS 10.0 insecure deserialization vulnerability in React Server Components, from reconnaissance to...

CVE-2025-55182-React2Shell-CVSS-10.0-

Affected Software: React Server Components versions 19.0.0, 19.1.0, 19.1.1, 19.2.0 Vulnerability Type: Pre-authentication Remote Code Execution via insecure deserialization. Description: A flaw in the React Server Flight protocol allows unauthenticated attackers to send specially crafted serializ...

React Server Components - Denial of Service

React Server Components 19.0.0 to 19.2.1 including react-server-dom-parcel, react-server-dom-turbopack, and react-server-dom-webpack contain an insecure deserialization vulnerability caused by unsafe payload deserialization in Server Function endpoints, letting unauthenticated attackers cause...

CVE-2025-55182-analysis

I. Vulnerability Overview In the past couple of days, there has been widespread discussion about a deserialization RCE vulnerability in React. The official CVSS score is a full 10.0, on par with Log4j. Rumors quickly spread claiming it is the "Log4j of modern frontend," causing panic among...

CVE-2025-55182

CVE-2025-55182 Next.js RCE Exploit Tool 🚀 This is an automated Proof-of-Concept PoC tool for the Next.js React Server Components CVE-2025-55182 Remote Code Execution RCE vulnerability. The tool integrates an interactive Shell , intelligent protocol detection , and multi-threaded batch scanning...

react2shell

React2Shell CLI tool + Nuclei templates for detecting two critical RCE vulnerabilities in React Server Components and Next.js Server Actions. The scanner was rewritten based on the disclosed react2shell vuln. Vulnerability Overview CVE-2025-55182 – React Server Components Deserialization RCE A fl...

React2Shell-CVE-2025-55182-An-lise-T-cnica

React2Shell CVE-2025-55182 📖 Overview This repository documents the security concepts studied in the TryHackMe room regarding CVE-2025-55182 , a critical vulnerability affecting: React Server Components RSC Next.js and RSC-based frameworks Packages: react-server-dom-webpack react-server-dom-parce...

CVE-2025-55182

CVE-2025-55182 Scanner A proof-of-concept scanner for CVE-2025-55182 , a critical unauthenticated Remote Code Execution RCE vulnerability in React Server Components RSC. Overview On December 3, 2025, a critical vulnerability was disclosed affecting React 19.x and Next.js applications using React...

CVE-2025-55182-poc-tool

CVE-2025-55182-poc-tool A powerful exploit tool for detecting and exploiting CVE-2025-55182 vulnerability in Next.js React Server Components. This tool allows remote command execution RCE in vulnerable Next.js applications with built-in WAF bypass capabilities. Overview CVE-2025-55182 is a critic...

CVE-2025-55182

CVE-2025-55182 - React2Shell React Server Components / Next.js Pre-Authentication Remote Code Execution Property| Value ---|--- CVE ID| CVE-2025-55182 CVSS| 10.0 Critical CWE| CWE-502: Deserialization of Untrusted Data Type| Pre-Auth RCE Affected Versions Component| Affected Versions ---|--- Reac...

CVE-2025-55182_PoC

CVE-2025-55182 - React Server Components RCE PoC Author: rl0x01 Description CVE-2025-55182 is a critical CVSS 10.0 Remote Code Execution RCE vulnerability affecting React Server Components via the Flight protocol. Vulnerable Versions Next.js| React ---|--- 14.3.0-canary.77 to 15.0.4| 19.0.0...

JEFAZO-CVE-2025-55182-Checker

JEFAZO-CVE-2025-55182-Checker Description JEFAZO-CVE-2025-55182-Checker is a passive analysis tool designed to identify indicators related to CVE-2025-55182 in applications built with Next.js and React Server Components RSC. The tool performs safe and non-intrusive checks, without attempting to...

React2Shell-CVE-2025-55182-Testing-Environment

React2Shell CVE-2025-55182 Testing Environment A containerized testing environment for CVE-2025-55182, a critical 10.0 CVSS Remote Code Execution vulnerability in React Server Components. ⚠️ WARNING This environment is intentionally vulnerable and should ONLY be used for: Security research and...

CVE-2025-55182

CVE-2025-55182 RCE Self-use checking tool for CVE-2025-55182 vulnerability Vulnerability Principle React Server Components has a path resolution flaw when decoding payloads sent to server function endpoints. It uses colon-separated object properties to implement nested value access e.g., $1🅰️b...

CVE-2025-55182-Scanner

CVE-2025-55182 RCE Scanner Batch detection and verification tool for CVE-2025-55182 React2Shell remote code execution vulnerability. ⚠️ CVSS 10.0 Critical Vulnerability | Affects React Server Components and Next.js 15.x/16.x versions | For authorized security testing only Vulnerability Overview...

react-ssr-vulnerability

CVE-2025-55182 - React Server Components RCE POC This is POC for educational and security research purposes only. This vulnerability has been patched in the latest versions of the affected packages. Use this tool only on systems you own or have explicit permission to test. I am not liable for any...