HackIndex.IO - React2Shell - CVE-2025-55182 + CVE-2025-66478

A HackIndex.io sandbox environment for the React2Shell vulnerability. This will start a web app on port 3000, and a SSH server on port 2222.

Start the environment

docker compose up --build --force-recreate

SSH Web admin (Port 2222)

• webadmin - TrainingPassword123!

ssh [email protected] -p 2222 -o StrictHostKeyChecking=no -o UserKnownHostsFile=/dev/null

Remove all containers

docker compose down -v

Mitigate issue

cd /app # Change to the web app directory
npm audit # Check for issues
supervisorctl stop next # Stop the web app
npm audit fix --force # Fix the security issues
npm run build # Rebuild the web app
supervisorctl start next # Start the web app