degenwithheart/react2shell-vulnerability-verification-scriptStandalone Python script to verify if a project is affected by CVE-2025-55182 (React2Shell). Checks package.json dependencies and performs optional deep codebase scan for React Server Component patterns.
verify_react_vulnerability.py)This is a simple, standalone Python script created to help you quickly determine if your project is affected by the critical React2Shell vulnerability (also known as CVE-2025-55182).
It performs a two-level check:
package.json file for known vulnerable versions of React and Next.js.package.json: It looks for the file in the directory where it is run.package.jsonreact and next listed in your project.npm install command to update to a safe version."use server""use client"createSafeActionClientregisterServerReferencereact-server-dom-webpackpython3 --version.pip install packaging
Make sure the verify_react_vulnerability.py script is in the root directory of your project (the same directory as your package.json).
Open your terminal and run the command:
python3 verify_react_vulnerability.py
If a vulnerable library version is found, the script stops and reports the issue immediately:
--- Step 1: Checking versions in package.json ---
❌ VULNERABLE: Found React version 19.0.1.
...
-------------------------------------------------
❌ SUMMARY: Your project is VULNERABLE based on dependency versions.
Please update the following dependencies immediately.
--- Recommended Fixes ---
npm install [email protected] [email protected]
...
-------------------------------------------------
If your dependencies are safe, the script will offer the deep scan.
--- Step 1: Checking versions in package.json ---
✅ OK: Found React version 18.3.1. Not in a known vulnerable range.
...
-------------------------------------------------
✅ INFO: Your project's dependencies do not seem to be affected by React2Shell.
However, vulnerable features might be in use if code was copy-pasted or 'vendored'.
Do you want to perform a comprehensive deep code scan? (y/n): y
If the deep scan finds indicators, it will provide a detailed report:
--- Step 2: Performing Comprehensive Deep Code Scan ---
Searching for patterns related to React Server Components...
⚠️ WARNING: Deep scan found indicators of React Server Component usage.
This does not guarantee a vulnerability, but warrants a manual review.
Ensure your framework versions are fully patched.
- Found pattern '"use server"':
Reason: Indicates a file contains React Server Actions, the primary feature associated with the vulnerability.
In files: ['src/actions/auth.ts']
- Found pattern '"use client"':
Reason: Indicates a Client Component, which may import and use Server Actions from other files.
In files: ['src/components/LoginButton.tsx', 'src/components/ThemeSwitcher.tsx']
-------------------------------------------------
If the deep scan finds nothing, it will confirm your project is likely safe:
--- Step 2: Performing Comprehensive Deep Code Scan ---
Searching for patterns related to React Server Components...
✅ OK: The comprehensive deep scan did not find any indicators of RSC usage.
-------------------------------------------------