hamm0nz/react2shell-auditA lightweight, recursive Bash script to detect Next.js and React Server DOM versions vulnerable to CVE-2025-55182 (React2Shell) in local projects.
React2Shell Audit is a lightweight, recursive Bash script designed to detect local Next.js and React Server DOM installations vulnerable to CVE-2025-55182 (React2Shell) and CVE-2025-66478.
React2Shell is a critical remote code execution (RCE) vulnerability in React Server Components (RSC). It allows unauthenticated attackers to execute arbitrary code on the server via the RSC "Flight" protocol.
This tool helps developers and security engineers instantly audit their local development environment or CI/CD pipelines to ensure their dependencies are patched.
node_modules to ensure speed).node_modules rather than the vague ranges in .package.json19.0.1 is safe for the 19.0 branch, while 19.1.0 is vulnerable).jq support for higher precision).git clone https://github.com/hamm0nz/react2shell-audit.git
cd react2shell-audit
chmod +x scan.sh
./scan.sh
Starting Recursive Scan for React2Shell...
---------------------------------------------------
Checking: ./apps/legacy-dashboard
react-server-dom-webpack: [VULNERABLE] 19.1.0 (Update to >= 19.1.2)
next: [VULNERABLE] 15.1.3 (Update to >= 15.1.9)
---------------------------------------------------
Checking: ./apps/marketing-site
next: [SAFE] 15.1.9
---------------------------------------------------
Scan Complete.
This tool is for educational and audit purposes. Always refer to official advisories from Vercel and Meta for the most up-to-date patch information. The authors are not responsible for missed vulnerabilities.