changgun-lee/next.js-rsc-rce-scanner-cve-2025-66478CLI scanner that detects whether a target website runs a vulnerable Next.js version affected by CVE-2025-66478 RCE in React Server Components.
CVE-2025-66478 Next.js vulnerability scanner. Detects whether a website is using a version of Next.js affected by the RSC (React Server Components) RCE vulnerability.
uv is a fast Python package manager.
# macOS/Linux
curl -LsSf https://astral.sh/uv/install.sh | sh
# Windows (PowerShell)
powershell -ExecutionPolicy ByPass -c "irm https://astral.sh/uv/install.ps1 | iex"
# Create virtual environment and install dependencies
uv venv
source .venv/bin/activate # Windows: .venv\Scripts\activate
uv pip install -r requirements.txt
# Install Playwright browser
playwright install chromium
# Run the scanner
python scanner.py <URL>
# Using uv run allows execution without a virtual environment
uv run --with playwright scanner.py <URL>
# However, Playwright browser must be installed separately
uv run --with playwright playwright install chromium
pip install -r requirements.txt
playwright install chromium
python scanner.py <URL>
# Scan a website
python scanner.py https://example.com
# Set timeout (default: 30000ms)
python scanner.py https://example.com --timeout 60000
0: Safe (patched version or not using Next.js)1: Vulnerable2: Unknown (version could not be determined)