React2Shell-CVE-2025-55182-Detector

Prerequisites

• Access to the project root directory containing package.json
• One of the following runtimes, depending on the script used:
  • Python
  • Javascript
  • PowerShell
  • Bash with jq installed

Usage

All scripts must be executed from the root directory of the target project where the package.json file is located.

1. Python Detection

Run the Python script for reliable semantic version comparison:

python3 scripts/python/check_react_versions.py

2. JavaScript (Node.js) Detection

Use this option if Node.js is available in the environment:

node scripts/javascript/check_react_versions.js

3. PowerShell Detection

Recommended for Windows-based systems and servers:

.\scripts\powershell\Check-ReactVersions.ps1

4. Bash Detection

Run the shell script. This requires jq for JSON parsing:

bash scripts/bash/check_react_versions.sh

Output

Each script analyzes the React dependency version and returns one of the following statuses:

• VULNERABLE: A known affected React version was detected
• SAFE: No vulnerable versions were found
• ERROR: The package.json file could not be located or parsed

Mitigation Guidance

If a script reports a VULNERABLE status, take immediate action:

Upgrade
Update the React dependency to a version outside the affected ranges.

Verify
Re-run the detection script after upgrading to confirm the project is no longer vulnerable.

Disclaimer

These scripts are intended for detection and security validation purposes only. They do not exploit the vulnerability and should be used as part of a broader security assessment strategy.