React2Shell Vulnerability Checker

CVE-2025-55182 Detection Tool for Ubuntu Linux and Windows 10/11

Description

This tool detects potential React2Shell vulnerabilities (CVE-2025-55182) in React projects by checking:

• package.json and lock files for vulnerable packages
• node_modules directory for affected dependencies
• URLs passively for remote detection

Important Note: This tool is for detection only (local and passive on URLs) — it does not contain exploit code or vulnerability exploitation steps.

Packages Checked

This tool will check for the following packages:

• react-server-dom-webpack
• react-server-dom-parcel
• react-server-dom-turbopack
• react (version 19.x.x - due to potential involvement in the vulnerability)

Patched Versions

If a vulnerability is found, ensure you upgrade to the following patched versions:

• react-server-dom-webpack, react-server-dom-parcel, react-server-dom-turbopack: versions 19.0.1, 19.1.2, or 19.2.1

Installation

Ubuntu Linux

# Create a virtual environment (optional but recommended)
python3 -m venv venv
source venv/bin/activate  # Activate the virtual environment

# Install dependencies
pip install -r requirements.txt

# Or use the installation script
chmod +x install_linux.sh
./install_linux.sh

Windows 10/11

# Open Command Prompt as Administrator
# Install dependencies
pip install -r requirements.txt

# Or use the installation script
install_windows.bat

Cross-Platform Installation

# For Ubuntu Linux
python3 install_cross_platform.py

# For Windows 10/11
python install_cross_platform.py

Usage

Local Scan

# Scan a local project
python3 react2shell_checker.py --path /path/to/your/project

# On Windows
python react2shell_checker.py --path C:\path\to\your\project

URL Scan

# Passively check a URL
python3 react2shell_checker.py --url https://your-site.example

# On Windows
python react2shell_checker.py --url https://your-site.example

Example Output

If Safe

[INFO] Scanning path: /path/to/your/project
[INFO] Found package.json: /path/to/your/project/package.json
[SAFE] No vulnerabilities detected!

If Vulnerability Found

[INFO] Scanning path: /path/to/your/project
[INFO] Found package.json: /path/to/your/project/package.json
[WARNING] Found potential vulnerabilities:
  - [email protected]
  - [email protected]

[RECOMMENDATION] If any vulnerabilities are found, upgrade to patched versions:
  - For react-server-dom-* packages: 19.0.1, 19.1.2, or 19.2.1
  - For react: Upgrade to a patched version >= 19.x.x if needed

Additional Features

• Detects various lock file formats (package-lock.json, yarn.lock, pnpm-lock.yaml)
• Recursively searches for package.json files in subdirectories
• Passive URL checking to detect React applications
• Supports various version notations (^, ~, >=, <=)
• Intuitive command-line interface

System Requirements

• Python 3.6 or higher
• Python modules: requests, packaging
• Read access to project files (package.json, node_modules, etc.)

License

This tool is provided as a security detection tool to help developers identify and fix vulnerabilities in their projects. Use it responsibly in accordance with your organization's security policies.