🔍 GitHub CVE Scanner - Usage Guide

Script to scan GitHub repositories for known vulnerabilities in React and Next.js projects.

📋 Detected Vulnerabilities

The scanner checks the following CVEs:

• CVE-2025-55182: Vulnerability in React Server Components

  • Affects: React 19.0.0, 19.1.0, 19.1.1, 19.2.0
  • Fixed versions: 19.0.1, 19.1.2, 19.2.1
  • Packages checked: react, react-dom, react-server-dom-webpack, react-server-dom-parcel, react-server-dom-turbopack

• CVE-2025-66478: Vulnerability in Next.js App Router

  • Affects: Next.js 14.3 canary, 15.x, 16.x
  • Fixed versions: 14.3.0-canary.76+, 15.0.5+, 15.1.9+, 15.2.6+, 15.3.6+, 15.4.8+, 15.5.7+, 15.6.0-canary.58+, 16.0.7+, 16.1.0-canary.12+

🚀 How to Use

Prerequisites

1. A modern web browser (Chrome, Firefox, Edge, etc.)
2. Access to GitHub (optional: Personal Access Token for private repositories)

Step by Step

1. Open the Browser Console

1. Go to any GitHub page (e.g., https://github.com)
2. Open DevTools:
   • Chrome/Edge: F12 or Ctrl+Shift+I (Windows) / Cmd+Option+I (Mac)
   • Firefox: F12 or Ctrl+Shift+K (Windows) / Cmd+Option+K (Mac)
3. Go to the Console tab

2. Copy and Run the Script

1. Open the main.js file
2. Copy the entire content of the file
3. Paste it into the browser console
4. Press Enter to run

3. Configure the Scan

The script will ask a series of interactive questions:

3.1. Authentication (First Question)

🔐 Scan private repos too?

OK = Enter PAT
Cancel = Public only

• OK: You will be asked to enter a GitHub Personal Access Token (PAT)
  • Allows scanning private repositories
  • Required to access organizations
• Cancel: Only public repositories will be scanned

How to create a PAT:

1. Go to: https://github.com/settings/tokens
2. Click "Generate new token" → "Generate new token (classic)"
3. Give it a descriptive name
4. Select the repo scope (full repository access)
5. Click "Generate token"
6. Copy the token immediately (it won't be shown again)

3.2. Scan Scope (If authenticated)

🔍 What do you want to scan?

OK = Organizations
Cancel = User Profile

• OK: Scan organizations
• Cancel: Scan only the user profile

3.3. Organization Selection (If you chose Organizations)

🏢 Scan all organizations?

OK = All organizations
Cancel = Single organization

Option A - All organizations (OK):

• The script will automatically fetch all organizations the authenticated user belongs to
• It will scan all repositories from all organizations

Option B - A specific organization (Cancel):

• You will be asked to enter the organization URL or name:
  root@kitploit:~

  🔗 Enter organization URL or name:
  
  Example: github.com/my-org or my-org
  

• Accepted formats:
  • github.com/my-org
  • https://github.com/my-org
  • my-org (just the name)

3.4. User Profile (If not authenticated or chose Profile)

• If you are on a GitHub profile page, the script will detect it automatically
• Otherwise, you will be asked:
  root@kitploit:~

  Enter GitHub username:
  

📊 Features

✨ Branch Checking

The script checks all branches of each repository, not just the default branch. This ensures vulnerabilities in development, staging, or other active branches are detected.

🏢 Organization Support

• Scans repositories from GitHub organizations
• Option to scan all organizations or a specific one
• Supports entering the organization URL or name

🔒 Private Repository Access

With a valid Personal Access Token, the script can:

• Access private repositories
• Scan private organizations
• Check branches of private repositories

📈 Results

After execution, the script will display:

Results Table

A table in the console showing:

• Repo: Repository name
• Branch: Branch name checked
• Next: Next.js version (if present)
• React: React version (if present)
• ReactDOM: react-dom version (if present)
• RSCWebpack: react-server-dom-webpack version (if present)
• RSCParcel: react-server-dom-parcel version (if present)
• RSCTurbopack: react-server-dom-turbopack version (if present)
• Status: Vulnerability status
  • ✅ Safe: No vulnerabilities detected
  • ⚠️ CVE-XXXX-XXXXX: Vulnerability found

Summary

📊 Summary:
   Total repos:       15
   Branches scanned:  23
   With package.json: 20
   Skipped:           3 (no package.json)

⚠️ 5 vulnerable repo(s) found!

or

✅ No vulnerabilities found!

⚙️ Technical Settings

• Delay between API requests: 200ms (to avoid rate limiting)
• Delay between scans: 30ms
• Results per page: 100 items
• Support for private repositories: Yes (with PAT)
• Branch checking: All branches of each repository

🔧 Troubleshooting

Error: "Token invalid"

• Check that the token was copied correctly
• Make sure the token has the repo scope
• Check if the token has expired

Error: "No repositories found"

• Verify that the user/organization exists
• If scanning organizations, check that you have access
• Check if there are repositories in the profile/organization

Error: "No organizations found"

• Verify that you are authenticated with a valid token
• Make sure you are part of organizations
• The token needs permissions to access organizations

Scan too slow

• The script introduces intentional delays to avoid rate limiting
• Repositories with many branches will take longer
• Organizations with many repositories will take longer

📝 Important Notes

1. Rate Limiting: The script respects GitHub API limits with automatic delays
2. Privacy: The token is used only locally in the browser, not sent to external servers
3. Accuracy: The scanner only checks the package.json in the repository root
4. Branches: All branches are checked, but only those with a package.json are reported
5. Versions: The scanner detects vulnerable versions based on the CVE definitions

🛡️ Security

• The script runs entirely in the browser (client-side)
• No data is sent to external servers
• The Personal Access Token is used only for requests to the GitHub API
• It is recommended to use tokens with the minimum necessary scopes

📄 License

MIT License

🔄 Version

3.0.0

Developed to detect security vulnerabilities in React and Next.js projects