dotnetguard/cve-2025-55182-exploitCVE-2025-55182 — Next.js Flight Deserialization RCE exploit with interactive shell, single-command execution and multi-payload reverse shell chain. For authorized penetration testing only.
Remote Code Execution exploit for Next.js Server Actions (Flight) deserialization vulnerability
This repository contains a working exploit for CVE-2025-55182, a
deserialization vulnerability in the Next.js Flight protocol (Server
Actions). By crafting a malicious Flight chunk, an unauthenticated attacker
can pollute the __proto__ chain (then / constructor gadget), reach the
child_process module and achieve arbitrary remote code execution on the
target server.
The exploit retrieves command output by smuggling it inside the NEXT_REDIRECT
error digest, giving you a clean, stateless RCE primitive on every request.
This tool is for authorized security assessments, penetration tests and CTF challenges only. You are responsible for complying with all applicable laws and for having explicit written permission to test any target. The author assumes no liability for misuse.
whoami, id, file reads, anythingrequests (PEP 723 inline script compatible)git clone https://github.com/dotnetguard/CVE-2025-55182-Exploit.git
cd CVE-2025-55182-Exploit
# Option A — classic
pip install requests
python3 exploit.py
# Option B — uv (PEP 723 inline dependencies)
uv run exploit.py