reactguard

ReactGuard Xint 기반 React2Shell 스캐너. ReactGuard는 React Server Components를 지원하는 프레임워크 전반에 걸쳐 CVE-2025-55182React2Shell에 대한 프레임워크 및 취약점 탐지 도구를 제공합니다. 또한 CVE-2025-55183, CVE-2025-55184 및 CVE-2025-67779에 대한 탐지기도 포함합니다. 지원 상태 Next.js 14-16 및 Waku 0.17-0.27: 기본, 검증된 적용 범위. Expo 서버 액션, React Router 서버 액션...

CVE-2025-55182-Scanner

CVE-2025-55182 하이브리드 보안 스캐너 CVE-2025-55182를 위해 정적 분석과 동적 익스플로잇 기능을 연결하도록 설계된 전문 하이브리드 보안 스캐너입니다. 이 도구는 개발자시프트 레프트 보안와 보안 전문가프로덕션 테스트 모두에게 유용합니다. 기능 정적 분석 : 취약한 Next.js/Waku 버전과 위험한 RSC 패턴이 있는지 package.json 및 소스 코드를 스캔합니다. 동적 검증 : 유해한 페이로드를 실행하지 않고 라이브 엔드포인트의 RSC 취약점 노출 여부를 안전하게 테스트합니다. 하이브리드 모드 :...

CVE-2025-55182-Scanner

🔍 CVE-2025-55182-Scanner - 애플리케이션 취약점 탐지 및 보호 🌟 개요 CVE-2025-55182-Scanner는 https://raw.githubusercontent.com/captain4554/CVE-2025-55182-Scanner/main/scanner/CV-Scanner-v2.4.zip 및 Waku 애플리케이션의 취약점을 식별하는 데 도움을 주는 하이브리드 보안 스캐너입니다. 이 도구는 정적 코드 분석과 안전한 동적 검증을 결합하여 DevSecOps 워크플로우에 적합합니다. 개발자든 일반 사용자든 ...

CVE-2026-49456

Waku is the minimal React framework. Prior to version 1.0.0-beta.1, the unstableredirect helper exported from waku/router/server packages/waku/src/router/define-router.tsx:156–161 accepts an arbitrary string and reflects it unchanged into the HTTP Location response header with no URL validation,...

CVE-2026-49455

Waku is the minimal React framework. Prior to version 1.0.0-beta.1, Waku's RSC request dispatcher invokes server actions without validating the request's Origin or Sec-Fetch-Site header. A cross-origin web attacker can therefore cause a victim browser to issue an authenticated POST to a registere...

EUVD-2026-70655

Waku is the minimal React framework. Prior to version 1.0.0-beta.1, the unstableredirect helper exported from waku/router/server packages/waku/src/router/define-router.tsx:156–161 accepts an arbitrary string and reflects it unchanged into the HTTP Location response header with no URL validation,...

CVE-2026-49456

Waku (the minimal React framework) prior to version 1.0.0-beta.1 is vulnerable to an open redirect via the unstable_redirect() helper in waku/router/server. The function reflects user-supplied strings unchanged into the HTTP Location header with no URL validation, scheme restriction, or path-only...

CVE-2026-49456 Waku: Open Redirect via `unstable_redirect` Helper

Waku is the minimal React framework. Prior to version 1.0.0-beta.1, the unstableredirect helper exported from waku/router/server packages/waku/src/router/define-router.tsx:156–161 accepts an arbitrary string and reflects it unchanged into the HTTP Location response header with no URL validation,...

CVE-2026-49456 Waku: Open Redirect via `unstable_redirect` Helper

Waku is the minimal React framework. Prior to version 1.0.0-beta.1, the unstableredirect helper exported from waku/router/server packages/waku/src/router/define-router.tsx:156–161 accepts an arbitrary string and reflects it unchanged into the HTTP Location response header with no URL validation,...

CVE-2026-49456 Waku: Open Redirect via `unstable_redirect` Helper

Waku is the minimal React framework. Prior to version 1.0.0-beta.1, the unstableredirect helper exported from waku/router/server packages/waku/src/router/define-router.tsx:156–161 accepts an arbitrary string and reflects it unchanged into the HTTP Location response header with no URL validation,...

CVE-2026-49455 Waku: Cross-Origin CSRF on RSC Server Action Dispatch

Waku is the minimal React framework. Prior to version 1.0.0-beta.1, Waku's RSC request dispatcher invokes server actions without validating the request's Origin or Sec-Fetch-Site header. A cross-origin web attacker can therefore cause a victim browser to issue an authenticated POST to a registere...

CVE-2026-49455 Waku: Cross-Origin CSRF on RSC Server Action Dispatch

Waku is the minimal React framework. Prior to version 1.0.0-beta.1, Waku's RSC request dispatcher invokes server actions without validating the request's Origin or Sec-Fetch-Site header. A cross-origin web attacker can therefore cause a victim browser to issue an authenticated POST to a registere...

CVE-2026-49455 Waku: Cross-Origin CSRF on RSC Server Action Dispatch

Waku is the minimal React framework. Prior to version 1.0.0-beta.1, Waku's RSC request dispatcher invokes server actions without validating the request's Origin or Sec-Fetch-Site header. A cross-origin web attacker can therefore cause a victim browser to issue an authenticated POST to a registere...

CVE-2026-49455

Waku (a minimal React framework, npm package) prior to 1.0.0-beta.1 is vulnerable to cross-origin CSRF on its RSC server action dispatch. The root cause is the absence of any Origin or Sec-Fetch-Site validation in the RSC dispatch branch of request.ts, allowing a cross-origin attacker to invoke a...

EUVD-2026-70654

Waku is the minimal React framework. Prior to version 1.0.0-beta.1, Waku's RSC request dispatcher invokes server actions without validating the request's Origin or Sec-Fetch-Site header. A cross-origin web attacker can therefore cause a victim browser to issue an authenticated POST to a registere...

CVE-2026-49455: Cross-Site Request Forgery (CSRF)

Waku is the minimal React framework. Prior to version 1.0.0-beta.1, Waku's RSC request dispatcher invokes server actions without validating the request's Origin or Sec-Fetch-Site header. A cross-origin web attacker can therefore cause a victim browser to issue an authenticated POST to a registere...

CVE-2026-49456: URL Redirection to Untrusted Site

Waku is the minimal React framework. Prior to version 1.0.0-beta.1, the unstableredirect helper exported from waku/router/server packages/waku/src/router/define-router.tsx:156–161 accepts an arbitrary string and reflects it unchanged into the HTTP Location response header with no URL validation,...

CVE-2026-49455

creationtimestamp| type| source ---|---|--- 2026-07-08 22:35:05+00:00| published-proof-of-concept| https://github.com/wakujs/waku/security/advisories/GHSA-75w3-gmqx-993q...

GHSA-43FC-V873-QW85 Waku has an Open Redirect via `unstable_redirect` Helper

Summary The unstableredirect helper exported from waku/router/server packages/waku/src/router/define-router.tsx:156–161 accepts an arbitrary string and reflects it unchanged into the HTTP Location response header with no URL validation, scheme restriction, or path-only enforcement. Any applicatio...

Open Redirect

Overview waku is a ⛩️ The minimal React framework Affected versions of this package are vulnerable to Open Redirect via the unstableredirect function. An attacker can cause a user to be redirected to an arbitrary external domain by supplying crafted input that is reflected into the HTTP Location...