Proof-of-concept exploit for CVE-2025-55182 (React2Shell), demonstrating remote code execution in React Server Components through crafted Next-Action requests, with Docker test environment and patch reference.
Scans web targets for CVE-2025-55182 using assetnote's react2shell-scanner to detect exposed React development servers and report affected hosts.
Proof-of-concept scanner for CVE-2025-55182, an unauthenticated RCE in React Server Components. Supports batch scanning, JSON/CSV export, and interactive shell on vulnerable targets.
R2S is a comprehensive exploitation and post-exploitation framework targeting the Next.js React Server Components vulnerability (CVE-2025-55182). It provides an interactive shell with advanced features for penetration testing, including file transfer, persistence, enumeration, privilege escalation checks, and more.
A containerized testing environment for CVE-2025-55182, a critical (10.0 CVSS) Remote Code Execution vulnerability in React Server Components.
[React2Hell] Next.js/React Server RCE Exploit — CVE-2025-55182
浅谈React Server Components RCE 漏洞分析
Technical analysis of CVE-2025-55182 (React2Shell), covering vulnerability mechanics, root cause, controlled PoC testing, impact, and mitigation strategies.
I created simple react2shell CVE-2025-55182 python exploit
Working proof of concept for NextJS RCE to establish a reverse shell. [React2Shell]
Critical RCE vulnerability scanner for React Server Components (CVE-2025-55182). Automated exploitation framework with multi-payload support, proxy capabilities, and interactive command execution.
Proof-of-concept exploit for CVE-2025-55182, achieving remote code execution in React Server Functions via prototype pollution and crafted Flight protocol chunks.
Functional Python POC to test if servers are vulnerable to CVE-2025-55182
Python CLI exploit and scanner for CVE-2025-55182, a critical RCE in React Server Components, with command execution and nuclei-based detection.
CVE-2025-55182(命令执行、反弹shell、注入内存马)
Educational technical analysis of CVE-2025-55182, a critical unauthenticated RCE in React Server Components and Next.js via React Flight deserialization, covering root cause, impact, detection, and mitigation.
a critical Remote Code Execution (RCE) vulnerability in React Server Components (RSC). It also includes a realistic "Lab Environment" to safely test and understand the vulnerability.
Proof-of-concept exploit for CVE-2025-55182, demonstrating unauthenticated RCE in Next.js App Router via server-side object injection in React Server Components, with UTF-16LE WAF bypass.
* React2Shell-CVE-2025-55182
React2Shell vulnerability (CVE-2025-55182 / CVE-2025-66478) Full Script
Technical penetration testing writeup demonstrating exploitation of CVE-2025-55182 in Next.js, credential harvesting from SQLite, and privilege escalation via Node.js inspector to achieve root access.
Dockerized proof-of-concept for CVE-2025-55182, a critical RCE in React Server Components via prototype pollution, with automated exploit scripts and a vulnerable Next.js test environment.
A critical Remote Code Execution (RCE) vulnerability affecting the React Server Components (RSC) implementation within multiple packages including.
CVE-2025-55182-Advanced-Scanner is an automated security tool designed to detect and validate the CVE-2025-55182 vulnerability efficiently. it helps security researchers and bug bounty hunters quickly identify affected targets with accurate results and minimal false positives.
Defensive research repository for CVE-2025-55182 (Pre-Auth RCE in React Server Components/Next.js). Includes technical analysis, detection rules (Suricata/Sigma/YARA), mitigation guides, and an automated CVE monitoring system for security researchers and SOC analysts.
Proof-of-concept exploit for critical unauthenticated RCE in Next.js Server Actions via React Flight Protocol deserialization, enabling arbitrary command execution on vulnerable servers.
This is a POC script for CVE-2025-55182 (React SSR RCE)
Master's thesis research on CVE-2025-55182 (React2Shell). Modular exploitation framework with 6 attack scenarios (RCE, exfiltration, defacement), interactive reverse shell, and a complete vulnerable lab for studying Prototype Pollution and Insecure Deserialization in React Server Components.
A hands-on lab for understanding and exploiting CVE-2025-55182 (React2Shell) - Remote Code Execution in React Server Components
CVE-2025-55182 — Next.js Flight Deserialization RCE exploit with interactive shell, single-command execution and multi-payload reverse shell chain. For authorized penetration testing only.
Proof-of-concept exploit for CVE-2025-55182, demonstrating remote code execution via prototype chain vulnerability in React Server Components. Includes multiple RCE gadgets and persistence attacks.
Pre-auth RCE in React Server Components versions 19.0.0, 19.1.0, 19.1.1, and 19.2.0.
Proof-of-concept exploit for CVE-2025-55182 (React2Shell) RCE vulnerability in React Server Components. Includes a scanner for vulnerable hosts and a shell script for remote command execution. For authorized security testing and education only.
Header bypass for CVE-2025-55182 (React Server Components RCE).
Technical proof-of-concept and deep-dive analysis of CVE-2025-55182, a critical RCE vulnerability in React's Flight Protocol via path traversal, fake chunk injection, and $B handler abuse.
Chrome extension and Shodan scanner for detecting and demonstrating RCE vulnerabilities in React Server Components (RSC) and Next.js applications, with a CORS proxy helper for testing.
Docker-based test lab for CVE-2025-55182 (React2Shell) RCE vulnerability in React 19.1.0/Next.js 15.1.0. Includes exploit scripts, WAF bypass testing with NGINX/ModSecurity, and patched version comparison for security education.
POC for CVE-2025-55182
A test server for demonstrating and testing React2Shell (CVE-2025-55182) vulnerability
This repository provides a proof-of-concept for CVE-2025-55182 (React2Shell), a remote code execution vulnerability in React Server Components. It demonstrates how the exploit works, including the payload and impact.
A HackIndex.io sandbox environment for the React2Shell vulnerability.
Multi-technique vulnerability detector for CVE-2025-55182 in React/Next.js applications. Tests gadget chains, RCE payloads, and WAF bypass variants to identify vulnerable Server Actions endpoints.
Proof-of-concept exploit for CVE-2025-55182 (React2Shell), an unauthenticated remote code execution vulnerability in React Server Components via crafted Flight protocol payloads.
Automated proof-of-concept exploit for Next.js RCE (CVE-2025-55182) with interactive shell, batch scanning, and advanced payload encoding for security research and authorized penetration testing.
Python-based exploit for CVE-2025-55182 (React Server Components RCE) with interactive shell, reverse shell, batch scanning, and Docker-based vulnerable environment for authorized security testing.
Detailed technical analysis and proof-of-concept exploit for CVE-2025-55182, a critical RCE vulnerability in React's Flight Protocol. Covers path traversal, fake chunk injection, and WAF bypass techniques.
My research on CVE-2025-55182
This is an easy to use PoC script to exploit React2Shell-CVE-2025-55182 Nextjs vulnerability. This will help to gain a reverse shell.
Advanced RCE exploitation toolkit for React Server Components vulnerabilities. Features multiple pre-built payloads, Shodan integration for target discovery, and mass scanning for authorized penetration testing.
Python exploit for CVE-2025-55182 targeting Next.js RCE with single-target, mass scanning, interactive shell, and reverse shell capabilities.
Unified Security Research Tool
React2Shell is a proof-of-concept exploit for CVE-2025-55182 affecting vulnerable React Server Components (RSC) implementations in Next.js
CVE-2025-55182 Exploit | by infrar3d
Async RCE scanner for CVE-2025-55182 / CVE-2025-66478 — prototype-pollution → code execution via React Server Actions.
CVE-2025-55182 payload
Educational repository for learning CVE-2025-55182: a pre-authentication RCE in React Server Components. Includes step-by-step documentation, hands-on exercises, and a proof-of-concept exploit in a vulnerable Dockerized Next.js app.
A simple toolkit to validate, exploit & gain an interactive shell via the react2Shell Next.js RCE.
Educational lab demonstrating CVE-2025-55182: Critical RCE in React Server Components via prototype pollution in the Flight protocol
CVE-2025-55182 Exploit Tool – Python 2.7 exploit for Next.js prototype pollution leading to RCE
Automated RCE and SSRF exploit for CVE-2025-55182 in React/NextJS applications. Tests experimental-form feature vulnerabilities in authorized environments.
Security toolkit for CVE-2025-55182 (React2Shell) — scan, detect, correlate, and test React Server Components RCE vulnerability
Proof-of-concept exploit for CVE-2025-55182 (React2Shell), a critical RCE vulnerability in React Server Components via prototype pollution. Includes interactive and command-line exploitation modes.
Python PoC for CVE-2025-55182 (React2Shell) RCE in Next.js/React Server Components with dynamic WAF bypass padding for authorized security testing.
a realistic POC demonstrating the missing `hasOwnProperty` check in [email protected]
Detailed technical walkthrough of CVE-2025-55182 (React2Shell), tracing React's Flight protocol internals to explain the exploit chain, payload crafting, and fix analysis.
powerfull rust cve-2025-55182-scanner used for ctf & ethical purpose only
Go-based proof-of-concept for CVE-2025-55182, a critical RCE in React Server Components. Features vulnerability checking, command execution, memory shell injection, reverse shell, batch scanning, and proxy support for authorized security testing.
CodeQL-based analysis of CVE-2025-55182 prototype pollution vulnerability in React Server Components, with exploit POC and static detection queries for unsafe property traversal.
Documentation and analysis of CVE-2025-55182, a critical RCE vulnerability in React Server Components via unsafe deserialization, with affected versions, exploit details, and mitigation guidance.
This repository contains a POC of CVE-2025-55182, a critical (CVSS score 10.0) pre-authentication remote code execution vulnerability affecting React Server Components, also known as React2Shell.
CVE-2025-55182 RCE vulnerability in Next.js/React RSC servers (exploit and scanner)
Docker-based lab for detecting and exploiting CVE-2025-55182 (React2Shell RCE) in Next.js/React Server Components, with pre-configured vulnerable setup and PoC scanners.
Original proof-of-concept exploits for React2Shell (CVE-2025-55182), demonstrating remote code execution in Next.js applications via Webpack chunk parsing vulnerabilities.
Automated exploitation tool for CVE-2025-55182 (React/Next.js RCE) with command execution, outbound detection, interactive reverse shell, and persistent memory webshell injection for authorized penetration testing and CTF challenges.
Proof-of-concept exploit for CVE-2025-55182, a critical unauthenticated RCE in React Server Components. Includes a Python script demonstrating malicious HTTP request crafting against vulnerable Next.js/React versions.
Python exploit for CVE-2025-55182, a server-side JavaScript injection in Next.js/React enabling remote code execution via malformed multipart form data. Includes lab setup for authorized testing.
"One crafted HTTP request can compromise your entire server." — React Security Team, Dec 2025
CVE-2025-55182 React2Shell PoC
React2Shell Vulnerability
Pre-authentication remote code execution exploit for React Server Components and Next.js via deserialization vulnerability. Supports single-target and batch scanning with proxy and threading.
A proof-of-concept tool for demonstrating the critical React2Shell vulnerability
CVE-2025-55182 – React2Shell: Proof-of-Concept Remote Code Execution (RCE) exploit for Next.js apps. Features an interactive shell prompt to test and demonstrate the vulnerability in real time. Use for security research and authorized penetration-testing only.
Local lab for understanding CVE-2025-55182 RCE in React Server Components/Next.js. Includes a deliberately vulnerable app and optional scanner helper for education and blue teaming.
Intentionally vulnerable Next.js app for CVE-2025-55182 security research and CTF challenges
CVE-2025-55182 (React2Shell) PoC: Unauthenticated RCE affecting React 19.x and Next.js < 15.1.4. Exploits vulnerabilities in the RSC Flight protocol.
CVE-2025-55182
Detailed technical analysis of CVE-2025-55182 (React2Shell), a critical RCE vulnerability in React Server Components, including affected packages, exploitation mechanics, and patching guidance.
A modified and a little boosted exploit for CVE-2025-55182, React2Shell: Pre-authentication Remote Code Execution in React Server Packages
Security research & exploitation analysis of CVE-2025-55182 (React) — CVSS + OWASP Top 10 mapping
Proof-of-concept for CVE-2025-55182 (React2Shell): unauthenticated RCE in React Server Components / Next.js via Flight protocol deserialization.
Exploit for CVE-2025-55182 enabling remote code execution via prototype pollution in Next.js React Server Components, with command execution and reverse shell capabilities.
Interactive RCE exploit for CVE-2025-55182 targeting Next.js/React Server Components deserialization vulnerability. Features automatic detection, command execution, file transfer, and a built-in shell with history and autocompletion.
PoC exploit for CVE-2025-55182, demonstrating remote code execution in React Server Functions via prototype pollution and a crafted Flight Protocol payload.
A web-based vulnerability scanner for CVE-2025-55182, a critical Remote Code Execution (RCE) vulnerability in React Server Components.
Host-based detection rules for the RCE vulnerability in the React JavaScript framework.
Real-world attack analysis of CVE-2025-55182 (React2Shell) - React Server Components RCE vulnerability
Defensive research repository for CVE-2025-55182 (Pre-Auth RCE in React Server Components/Next.js). Includes vulnerability analysis, detection rules (Suricata, Sigma, YARA), mitigation guides, and an automated CVE monitoring system for tracking new disclosures and patches.
Demo of CVE-2025-55182 — Next.js RCE (for educational purposes)
CVE-2025-55182 React2Shell PoC - Critical RCE in React Server Components / Next.js. CVSS 10.0. Error-based exfil, reverse shell, interactive mode.
React2Shell vulnerability (CVE-2025-55182 / CVE-2025-66478)
