CVE-2025-55182

CVE-2025-55182 React2Shell Analysis Report Sections required by the assignment guidelines are marked with “Required”. 1. Environment Required 1.1. Dockerfile Required This environment uses a custom Dockerfile based on the official Node.js Alpine image. root@kitploit: FROM node:20-alpine WORKDIR...

react2shell-CVE-2025-55182-

This repository does not have a README...

PoC-CVE-2025-55182

该脚本利用了CVE-2025-55182，这是一个影响React.js和Next.js中使用的React Server Components的RCE漏洞。 受影响的React版本： 19.0.0 19.1.0和19.1.1 19.2.0 Next.js： Next.js 15.x（所有在修复之前的版本） Next.js 16.0.0（基于易受攻击的React 19构建的早期alpha/beta/RC版本） 使用方法 root@kitploit: git clone https://github.com/LuizHenz/PoC-CVE-2025-55182 cd...

r2s

R2S - React2Shell Scanner A web-based vulnerability scanner for CVE-2025-55182 , a critical Remote Code Execution RCE vulnerability in React Server Components. Live Scanner: https://r2s.mxm0z.com About CVE-2025-55182 CVE-2025-55182 is a critical CVSS 10.0 vulnerability in the React Server...

react-CVE-2025-55182-fixer

React Server Components Security PR Automation This repository provides a script to automatically bump and create pull requests PRs for repositories affected byCVE-2025-55182, which affects vulnerable versions of react-server-dom- and related React packages. What does this tool do? Scans for...

CVE-2026-84997 react/http: A malformed HTTP chunked body can lead to a denial-of-service and peg the CPU

react/http is an event-driven, streaming HTTP client and server implementation for ReactPHP. From 0.6.0 until 1.11.1, React\Http\Io\ChunkedDecoder could enter an infinite loop while processing a malformed Transfer-Encoding: chunked body because handleData required its buffer to shrink on every...

CVE-2026-84997 react/http: A malformed HTTP chunked body can lead to a denial-of-service and peg the CPU

react/http is an event-driven, streaming HTTP client and server implementation for ReactPHP. From 0.6.0 until 1.11.1, React\Http\Io\ChunkedDecoder could enter an infinite loop while processing a malformed Transfer-Encoding: chunked body because handleData required its buffer to shrink on every...

CVE-2026-84997

react/http (ReactPHP) is vulnerable to a denial-of-service via a malformed HTTP chunked body. The ChunkedDecoder enters an infinite loop when it receives either an incomplete terminal-chunk trailer without CRLF or exactly two non-CRLF bytes after a completed non-terminal chunk, because handleData...

RSC-Infra-Scanner

RSC Infra Scanner rscinfrascan.py is a fast, asynchronous Python tool that fingerprints domains for likely Next.js App Router / React Server Components RSC infrastructure. It does not exploit any vulnerabilities. It only performs passive HTTP/HTML/header fingerprinting to help you identify target...

React-Router-CVE-2025-61686-

Informe de análisis de la vulnerabilidad CVE-2025-61686 Resumen de la vulnerabilidad CVE ID : CVE-2025-61686 Versiones afectadas : @react-router/node 7.0.0 a 7.9.3 Tipo de vulnerabilidad : Path Traversal / Directory Traversal Principio de la vulnerabilidad 1. Ubicación de la vulnerabilidad La...

nextjs-rce-incident-response

Next.js RCE Incident Response — CVE-2025-55182 Type: Live Production Incident Response Vulnerability: CVE-2025-55182 — React Server Components Insecure Deserialization RCE Affected System: Next.js frontend + remote production server Role: Cyber Security Intern — SenseLive Technologies Date:...

CVE-2025-55182

CVE-2025-55182 This repository contains a PoC reproduction of CVE-2025-55182 , a critical security vulnerability in React Server Components RSC that allows unauthenticated arbitrary code execution. Description The vulnerability exists in how React Server Components deserialize "Server Actions" fr...

React-site-CVE-2025-55182

React Site - CVE-2025-55182 README: Vulnerable Next.js project React RSC landing page This repository contains an example of a multi-page corporate landing page built with Next.js 15.0.0 + React 19.0.0. The site mimics a structure similar to t1.ru: home, products, cases, media, about, contacts. W...

CVE-2025-55182-React2Shell-RCE

CVE-2025-55182 - React2Shell（React 服务端组件中的未认证 RCE） CVE-2025-55182，又称 React2Shell ，是一个严重的未认证远程代码执行（RCE） 漏洞，影响 React 服务端组件包（版本 19.0、19.1.0、19.1.1 和 19.2.0）。 该漏洞可能允许攻击者通过单个精心构造的 HTTP 请求 在易受攻击的服务器上实现任意代码执行，无需进行身份验证。 概述 React 服务端组件使用 Flight 协议 在客户端和服务器之间序列化和反序列化组件数据。...

CVE-2025-55182

CVE-2025-55182 POC This repository contains a proof of concept POC for CVE-2025-55182, demonstrating the vulnerability and its exploitation. Weak server root@kitploit: "dependencies": "next": "16.0.6", "react": "19.2.0", "react-dom": "19.2.0" , Weak server 2 root@kitploit: "dependencies": "next":...

k4_cve-2023-41064

k4cve-2023-41064 运行项目的步骤 设置前端： 导航到前端文件夹： root@kitploit: Copier Modifier cd frontend 通过运行以下命令安装所需的Node.js依赖项： root@kitploit: Copier Modifier npm install 设置后端： 导航到后端文件夹： root@kitploit: Copier Modifier cd backend 通过运行以下命令安装所需的Python依赖项： root@kitploit: Copier Modifier pip install -r requirements.txt...

CVE-2025-55182

CVE-2025-55182 Vulnerable Application Build and run: root@kitploit: docker compose build docker compose run --rm --entrypoint 'npm install' node docker compose run --rm --entrypoint 'npm run build' node docker compose up POC from https://github.com/msanft/CVE-2025-55182: root@kitploit: node poc.j...

React2Shell-Exploit-CVE-2025-55182

💀 React2Shell 漏洞利用 — CVE-2025-55182 root@kitploit: ██████╗ ███████╗ █████╗ ██████╗████████╗██████╗ ███████╗██╗ ██╗███████╗██╗ ██╗ ██╔══██╗██╔════╝██╔══██╗██╔════╝╚══██╔══╝╚════██╗██╔════╝██║ ██║██╔════╝██║ ██║ ██████╔╝█████╗ ███████║██║ ██║ █████╔╝███████╗███████║█████╗ ██║ ██║ ██╔══██╗██╔══╝...

cve-2025-55182-react2shell-analysis

CVE-2025-55182 — React2Shell 漏洞分析 概述 本项目对 CVE-2025-55182 React2Shell 进行了技术分析，这是一个影响 React Server Components 的严重远程代码执行漏洞。 本研究的目的是理解该漏洞、分析其根本原因、在受控实验室环境中复现该问题，并研究适当的缓解策略。 本项目从攻击方和防御方两个安全视角来分析该漏洞。 漏洞详情 类别| 详情 ---|--- CVE| CVE-2025-55182 漏洞类型| 远程代码执行 RCE 受影响技术| React Server Components 严重程度| 严重 CVSS 评...

CVE-2024-25466

CVE-2024-25466 CVE-2024-25466 的描述 建议描述 React Native Document Picker 在 v.9.1.1 之前存在目录遍历漏洞，并在 v.9.1.1 中修复，允许本地攻击者通过精心设计的脚本对 Android 库组件执行任意代码。 漏洞类型 目录遍历 产品供应商 https://github.com/rnmods/react-native-document-picker/ 受影响产品代码库 react-native-document-picker android 库 - 适用于 Android 的...