CVE-2025-55182 Scanner

Vulnerability scanner for CVE-2025-55182 - Remote Code Execution in Next.js Server Actions.

About CVE-2025-55182

Severity: Critical (CVSS TBD)

Affected Versions:

• Next.js: 15.x < 15.5.7, 16.0.x < 16.0.7
• React: 19.0.0, 19.1.0, 19.1.1, 19.2.0

Impact: Remote attackers can execute arbitrary code on servers running vulnerable Next.js applications with Server Actions enabled. The vulnerability stems from improper handling of prototype pollution in the React Server Components protocol.

Fixed Versions:

• Next.js: ≥15.5.7 or ≥16.0.7
• React: ≥19.0.1, ≥19.1.2, or ≥19.2.1

Scanner Features

This tool performs comprehensive vulnerability assessment:

• RCE Detection: Executes multiple commands (whoami, id, pwd) to confirm exploitation
• Timing Analysis: Measures baseline response times to detect code execution
• Visual PoC: Demonstrates vulnerability by creating/deleting test files
• Version Detection: Identifies Next.js and React versions
• WAF Detection: Checks for security protections

Test Sequence

1. Connectivity and Next.js detection
2. WAF identification
3. Baseline timing measurement
4. Basic vulnerability checks