asadahmad-1337/react-2-shellThis is a security exploit tool targeting CVE-2025-55182. It exploits a Remote Code Execution (RCE) vulnerability in React Server Components
This is a security exploit tool targeting CVE-2025-55182. It exploits a Remote Code Execution (RCE) vulnerability in React Server Components
🔥 CVE-2025-55182 Background
CVE-2025-55182 (also widely referred to as “React2Shell”) is a critical remote code execution (RCE) vulnerability found in React Server Components (RSC) — part of the modern React.js ecosystem. It was publicly disclosed on December 3, 2025 and quickly added to the U.S. CISA Known Exploited Vulnerabilities Catalog, meaning active exploitation has been observed in the wild.
External Source : https://www.thehackerwire.com/vulnerability/CVE-2025-55182
python react-2-shell-ultimate.py -h (For Help Menu)
python react-2-shell-ultimate.py -t http://target.com -c "echo Testing"
python react-2-shell-ultimate.py -t http://target.com -c "hostname"
python react-2-shell-ultimate.py -t http://target.com -c "whoami" -v
Multipart POST (Original exploitation method)
JSON POST (JSON-formatted payload)
GET with Query Params (URL-based exploitation)
Windows-optimized (Windows-specific payloads)
File Output Method (Writes output to temporary files)
Form-urlencoded POST (Traditional form submission)
Dynamic payload construction with anti-detection measures
Command sanitization and escaping
Platform-specific payloads (Windows/Linux)
Multiple output extraction methods
Decodes encoded responses (URL encoding, escape sequences)
Extracts output from redirects, headers, and response bodies
Handles different error conditions
Random User-Agent rotation
SSL certificate verification bypass
Minimal/controlled verbose output
Unique test string generation for vulnerability confirmation
Non-destructive testing option
Python 3.6 and above
Operating System: Cross-platform (Windows/Linux/macOS)
pip install requests
pip install urllib3
