React2Shell Vulnerability Verification Script (verify_react_vulnerability.py)

What is this script?

This is a simple, standalone Python script created to help you quickly determine if your project is affected by the critical React2Shell vulnerability (also known as CVE-2025-55182).

It performs a two-level check:

1. Dependency Check: It inspects your package.json file for known vulnerable versions of React and Next.js.
2. Comprehensive Codebase Scan (Optional): If the dependency check passes, it offers to perform a deep scan of your source code. This scan looks for a wide range of clues that your project is using the vulnerable React Server Components feature set.

What does it do?

1. Finds package.json: It looks for the package.json file in the directory where it is run.
2. Reads Dependencies: It finds the exact versions of react and next listed in your project.
3. Compares Versions: It compares your installed versions against a built-in list of versions known to be vulnerable.
4. Provides a Fix: If a vulnerable dependency is found, the script provides the exact npm install command to update to a safe version.
5. Offers a Comprehensive Deep Scan: If your dependencies appear safe, it asks for permission to run a much deeper analysis of your code. This scan looks for multiple patterns, including:
   • "use server"
   • "use client"
   • createSafeActionClient
   • registerServerReference
   • react-server-dom-webpack
6. Reports Detailed Findings: If the deep scan finds any of the patterns, it provides a detailed report explaining what each pattern means and lists the files where they were found.

How to use it

Prerequisites

1. Python 3: You need to have Python 3 installed. You can check this by running python3 --version.
2. Packaging Library: The script uses a common Python library to compare software versions. If you don't have it, install it with pip:
   root@kitploit:~

   pip install packaging
   

Running the Script

1. Make sure the verify_react_vulnerability.py script is in the root directory of your project (the same directory as your package.json).

2. Open your terminal and run the command:

   root@kitploit:~

   python3 verify_react_vulnerability.py
   

Understanding the Output

Scenario 1: Vulnerable Dependency Found

If a vulnerable library version is found, the script stops and reports the issue immediately:

--- Step 1: Checking versions in package.json ---
❌ VULNERABLE: Found React version 19.0.1.
...
-------------------------------------------------

❌ SUMMARY: Your project is VULNERABLE based on dependency versions.
   Please update the following dependencies immediately.

--- Recommended Fixes ---
npm install [email protected] [email protected]
...
-------------------------------------------------

Scenario 2: No Vulnerable Dependencies (with Comprehensive Code Scan)

If your dependencies are safe, the script will offer the deep scan.

--- Step 1: Checking versions in package.json ---
✅ OK: Found React version 18.3.1. Not in a known vulnerable range.
...
-------------------------------------------------

✅ INFO: Your project's dependencies do not seem to be affected by React2Shell.
   However, vulnerable features might be in use if code was copy-pasted or 'vendored'.
   Do you want to perform a comprehensive deep code scan? (y/n): y

If the deep scan finds indicators, it will provide a detailed report:

--- Step 2: Performing Comprehensive Deep Code Scan ---
Searching for patterns related to React Server Components...

⚠️ WARNING: Deep scan found indicators of React Server Component usage.
   This does not guarantee a vulnerability, but warrants a manual review.
   Ensure your framework versions are fully patched.

   - Found pattern '"use server"':
     Reason: Indicates a file contains React Server Actions, the primary feature associated with the vulnerability.
     In files: ['src/actions/auth.ts']

   - Found pattern '"use client"':
     Reason: Indicates a Client Component, which may import and use Server Actions from other files.
     In files: ['src/components/LoginButton.tsx', 'src/components/ThemeSwitcher.tsx']
-------------------------------------------------

If the deep scan finds nothing, it will confirm your project is likely safe:

--- Step 2: Performing Comprehensive Deep Code Scan ---
Searching for patterns related to React Server Components...

✅ OK: The comprehensive deep scan did not find any indicators of RSC usage.
-------------------------------------------------