gensecaihq/react2shell-scannerDetects CVE-2025-55182 RCE in React Server Components by scanning npm/pnpm/yarn lockfiles, Docker images, SBOMs, and live URLs. Includes auto-fix, SARIF output, and CI/CD integrations.
Security scanner for CVE-2025-55182 - a critical (CVSS 10.0) unauthenticated Remote Code Execution vulnerability in React Server Components.
⚠️ DISCLAIMER
This is a security scanner, NOT an exploit tool. It is designed to help developers and security teams identify vulnerable dependencies in their projects.
This is a community-driven open source project provided "AS IS" without warranty of any kind, express or implied. The authors and contributors are not responsible for any damages or security incidents arising from the use of this tool.
Use at your own risk and responsibility. Always verify findings manually and follow your organization's security policies. If you discover any issues, bugs, or have suggestions, please contribute back to help improve the project for everyone.
🤝 CONTRIBUTORS WANTED
This project is actively looking for testers and contributors! Whether you want to report bugs, suggest features, improve documentation, or submit code - all contributions are welcome. Check out our Contributing Guide to get started.
This project exists to help the community respond to CVE-2025-55182. We acknowledge and thank:
The fastest way to check if your project is vulnerable:
npx react2shell-guard .
That's it! This will scan your current directory and show results immediately.
npx react2shell-guard /path/to/your/project
Found vulnerabilities? Fix them automatically:
# Preview what will be changed
npx react2shell-guard fix --dry-run
# Apply fixes
npx react2shell-guard fix
# Apply fixes and reinstall dependencies
npx react2shell-guard fix --install
Check if a deployed application is vulnerable:
npx react2shell-guard scan-url https://your-app.com
Confirm your deployed fix is working:
npx react2shell-guard verify-patch https://your-app.com
Check if your Docker images contain vulnerable packages:
npx react2shell-guard scan-image myapp:latest
Automatically create a GitHub PR to fix vulnerabilities:
npx react2shell-guard create-pr --dry-run # Preview
npx react2shell-guard create-pr # Create PR
On November 29th, 2025, security researcher Lachlan Davidson discovered and responsibly disclosed a critical vulnerability in React Server Components. The flaw exists in how React decodes payloads sent to React Server Function endpoints, allowing unauthenticated attackers to achieve remote code execution on affected servers without any user interaction.
CVE-2025-55182 is rated CVSS 10.0 (Critical) and affects React Server Components (RSC) and frameworks using the RSC "Flight" protocol.
Affected Packages:
react-server-dom-webpack 19.0.0, 19.1.0-19.1.1, 19.2.0react-server-dom-parcel (same versions)react-server-dom-turbopack (same versions)next 15.0.0-15.0.4, 15.1.0-15.1.8, 15.2.0-15.2.5, 15.3.0-15.3.5, 15.4.0-15.4.7, 15.5.0-15.5.6, 16.0.0-16.0.6More Information:
For frequent use, install globally:
npm install -g react2shell-guard
Then use without npx:
react2shell-guard .
# Scan current directory
react2shell-guard .
# Scan specific directory
react2shell-guard /path/to/project
# Scan and ignore certain paths
react2shell-guard . --ignore-path "examples/**" "test/**"
# Human-readable text (default)
react2shell-guard .
# JSON output (for scripting)
react2shell-guard . --json
# SARIF output (for GitHub Security tab)
react2shell-guard . --sarif
# HTML report (standalone, shareable)
react2shell-guard . --html report.html
| Option | Description |
|---|---|
--json | Output results as JSON |
--sarif | Output results as SARIF 2.1.0 |
--html <file> | Generate standalone HTML report |
--no-exit-on-vuln | Don't exit with code 1 when vulnerabilities found |
--ignore-path <patterns> | Paths to ignore (e.g., examples/**) |
--debug | Enable debug output |
| Code | Meaning |
|---|---|
0 | No vulnerabilities found |
1 | Vulnerabilities detected |
2+ | Fatal error |
Scan live endpoints to detect if they are vulnerable:
# Scan a single URL
react2shell-guard scan-url https://example.com
# Batch scan from a file (one URL per line)
react2shell-guard scan-url urls.txt --list
# With options
react2shell-guard scan-url https://example.com --timeout 5000 --json
The scanner uses passive fingerprinting to detect vulnerable React Server Components endpoints without exploiting the vulnerability:
Probe Request: Sends a crafted POST request simulating an RSC Server Action call with a minimal payload:
multipart/form-data content type with RSC-like data structureNext-Action header to trigger Server Action processingResponse Analysis: Analyzes the HTTP response for vulnerability signatures:
^[0-9]+:E{ - RSC Flight protocol error format"digest":"...RSC - RSC digest in error responsesReactServerComponentsError - React error class namestext/x-component.*error - Component error content typeNon-Destructive: This is purely a detection mechanism - it does not execute any malicious payload or exploit the vulnerability. The probe uses benign data that triggers error responses on vulnerable servers but causes no harm.
Note: A positive detection means the server is running a vulnerable version and returned an RSC-specific error signature. It does NOT mean the server was exploited.
| Option | Description |
|---|---|
--list | Treat target as a file containing URLs |
--threads <n> | Number of concurrent threads (default: 10) |
--timeout <ms> | Request timeout in milliseconds (default: 10000) |
--json | Output results as JSON |
--skip-ssl-verify | Skip SSL certificate verification |
--verbose | Show all results including non-vulnerable hosts |
Verify if a target has been patched against the vulnerability:
# Verify patch status (runs multiple scans for accuracy)
react2shell-guard verify-patch https://example.com
# With JSON output
react2shell-guard verify-patch https://example.com --json