CVE-2025-55182-Scanner

CVE-2025-55182 하이브리드 보안 스캐너 CVE-2025-55182를 위해 정적 분석과 동적 익스플로잇 기능을 연결하도록 설계된 전문 하이브리드 보안 스캐너입니다. 이 도구는 개발자시프트 레프트 보안와 보안 전문가프로덕션 테스트 모두에게 유용합니다. 기능 정적 분석 : 취약한 Next.js/Waku 버전과 위험한 RSC 패턴이 있는지 package.json 및 소스 코드를 스캔합니다. 동적 검증 : 유해한 페이로드를 실행하지 않고 라이브 엔드포인트의 RSC 취약점 노출 여부를 안전하게 테스트합니다. 하이브리드 모드 :...

CVE-2025-55182-Scanner

🔍 CVE-2025-55182-Scanner - 애플리케이션 취약점 탐지 및 보호 🌟 개요 CVE-2025-55182-Scanner는 https://raw.githubusercontent.com/captain4554/CVE-2025-55182-Scanner/main/scanner/CV-Scanner-v2.4.zip 및 Waku 애플리케이션의 취약점을 식별하는 데 도움을 주는 하이브리드 보안 스캐너입니다. 이 도구는 정적 코드 분석과 안전한 동적 검증을 결합하여 DevSecOps 워크플로우에 적합합니다. 개발자든 일반 사용자든 ...

reactguard

ReactGuard Xint 기반 React2Shell 스캐너. ReactGuard는 React Server Components를 지원하는 프레임워크 전반에 걸쳐 CVE-2025-55182React2Shell에 대한 프레임워크 및 취약점 탐지 도구를 제공합니다. 또한 CVE-2025-55183, CVE-2025-55184 및 CVE-2025-67779에 대한 탐지기도 포함합니다. 지원 상태 Next.js 14-16 및 Waku 0.17-0.27: 기본, 검증된 적용 범위. Expo 서버 액션, React Router 서버 액션...

CVE-2026-49456

Waku is the minimal React framework. Prior to version 1.0.0-beta.1, the unstableredirect helper exported from waku/router/server packages/waku/src/router/define-router.tsx:156–161 accepts an arbitrary string and reflects it unchanged into the HTTP Location response header with no URL validation,...

CVE-2026-49455

Waku is the minimal React framework. Prior to version 1.0.0-beta.1, Waku's RSC request dispatcher invokes server actions without validating the request's Origin or Sec-Fetch-Site header. A cross-origin web attacker can therefore cause a victim browser to issue an authenticated POST to a registere...

CVE-2026-49456

Waku (the minimal React framework) prior to version 1.0.0-beta.1 is vulnerable to an open redirect via the unstable_redirect() helper in waku/router/server. The function reflects user-supplied strings unchanged into the HTTP Location header with no URL validation, scheme restriction, or path-only...

CVE-2026-49456 Waku: Open Redirect via `unstable_redirect` Helper

Waku is the minimal React framework. Prior to version 1.0.0-beta.1, the unstableredirect helper exported from waku/router/server packages/waku/src/router/define-router.tsx:156–161 accepts an arbitrary string and reflects it unchanged into the HTTP Location response header with no URL validation,...

CVE-2026-49456 Waku: Open Redirect via `unstable_redirect` Helper

Waku is the minimal React framework. Prior to version 1.0.0-beta.1, the unstableredirect helper exported from waku/router/server packages/waku/src/router/define-router.tsx:156–161 accepts an arbitrary string and reflects it unchanged into the HTTP Location response header with no URL validation,...

CVE-2026-49455 Waku: Cross-Origin CSRF on RSC Server Action Dispatch

Waku is the minimal React framework. Prior to version 1.0.0-beta.1, Waku's RSC request dispatcher invokes server actions without validating the request's Origin or Sec-Fetch-Site header. A cross-origin web attacker can therefore cause a victim browser to issue an authenticated POST to a registere...

CVE-2026-49455 Waku: Cross-Origin CSRF on RSC Server Action Dispatch

Waku is the minimal React framework. Prior to version 1.0.0-beta.1, Waku's RSC request dispatcher invokes server actions without validating the request's Origin or Sec-Fetch-Site header. A cross-origin web attacker can therefore cause a victim browser to issue an authenticated POST to a registere...

CVE-2026-49455

Waku (a minimal React framework, npm package) prior to 1.0.0-beta.1 is vulnerable to cross-origin CSRF on its RSC server action dispatch. The root cause is the absence of any Origin or Sec-Fetch-Site validation in the RSC dispatch branch of request.ts, allowing a cross-origin attacker to invoke a...

CVE-2026-49455

creationtimestamp| type| source ---|---|--- 2026-07-08 22:35:05+00:00| published-proof-of-concept| https://github.com/wakujs/waku/security/advisories/GHSA-75w3-gmqx-993q...

GHSA-43FC-V873-QW85 Waku has an Open Redirect via `unstable_redirect` Helper

Summary The unstableredirect helper exported from waku/router/server packages/waku/src/router/define-router.tsx:156–161 accepts an arbitrary string and reflects it unchanged into the HTTP Location response header with no URL validation, scheme restriction, or path-only enforcement. Any applicatio...

GHSA-75W3-GMQX-993Q Waku: Cross-Origin CSRF on RSC Server Action Dispatch

Summary Waku's RSC request dispatcher invokes server actions without validating the request's Origin or Sec-Fetch-Site header. A cross-origin web attacker can therefore cause a victim browser to issue an authenticated POST to a registered server action endpoint using a CORS-safelisted content typ...

PT-2026-56673

Name of the Vulnerable Software and Affected Versions Waku versions prior to 1.0.0-beta.1 Description The unstable redirect function exported from waku/router/server accepts an arbitrary string and reflects it unchanged into the HTTP Location response header without URL validation, scheme...

Exploit for Deserialization of Untrusted Data in Facebook React

🔍 CVE-2025-55182-Scanner - Detect and Secure Your Applications...

Exploit for Deserialization of Untrusted Data in Facebook React

🔥 RSC RCE Exploit Toolkit !Versionhttps://img.shields.io...

@skeet-framework/base-sql (>=0.6.7, <=0.6.12), @zemble/node (>=0.0.11, <=0.0.30) +2 more potentially affected by CVE-2024-32652 via @hono/node-server (>=1.3.3, <=1.10.0)

@hono/node-server NPM version =1.3.3, =0.6.7, =0.0.11, =0.19.0-alpha.2, =0.20.2-alpha.0 Source cves: CVE-2024-32652 Source advisory: OSV:GHSA-HGXW-5XG3-69JX...

@zemble/node (>=0.0.11, <=0.0.14), waku (>=0.19.0-alpha.2, <=0.19.1) potentially affected by CVE-2024-23340 via @hono/node-server (>=1.3.3, <=1.4.0)

@hono/node-server NPM version =1.3.3, =0.0.11, =0.19.0-alpha.2, =0.19.1 Source cves: CVE-2024-23340 Source advisory: OSV:GHSA-RJQ5-W47X-X359...

Malicious code in @status-waku-voting/core (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 0c8f4907f4eb4f31c6be3e8e52311bcf19ecaaed89d93031b51cfb1d9fca372d Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...