Skip to content
KitploitKITPLOIT
ToolsBlog
Submit
ToolsBlog
Submit

Hacking, PenTest, and Cybersecurity Tools for Your Security Arsenal!

Kitploit is a directory of hacking, cybersecurity, and pentesting tools. Discover the latest project updates to find vulnerabilities, analyze systems, automate testing, and strengthen your security.

··Feeds·Contact·Privacy·© 2026 Kitploit

Tool Directory

Categories

View all categories
Loading categories
react2shell-vulnlab — A modern Next.js vulnerable web app themed as a news / blog portal for CVE-2025-55182 (React) and CVE-2025-66478 (Next.js) to learn, detect, and safely exercise React2Shell. Runs unpatched React 19.0.0 and Next.js 15.0.3. | Kitploit
Tools/GitHubGitHub/hidden-investigations/react2shell-vulnlab
Vulnerability AnalysisExploitationWeb Application ExploitationWeb SecurityCTFPenetration TestingLearning & EducationLabs & Practice
GitHub
hidden-investigations/react2shell-vulnlab

react2shell-vulnlab

A modern Next.js vulnerable web app themed as a news / blog portal for CVE-2025-55182 (React) and CVE-2025-66478 (Next.js) to learn, detect, and safely exercise React2Shell. Runs unpatched React 19.0.0 and Next.js 15.0.3.

View RepositoryWebsite
39 months agoNot yet reviewed

Most Popular

View all →

Discover the most used tools by our community.

Explore all tools

Browse our collection of tools

View all tools →
Share

React2Shell Tribune — VULNERABLE WEB APPLICATION LAB

logo

A modern Next.js web app themed as a news / blog portal for CVE-2025-55182 (React) and CVE-2025-66478 (Next.js) to learn, detect, and safely exercise React2Shell. Runs unpatched React 19.0.0 and Next.js 15.0.3.

Overview

  • Fictional news portal built with Next.js App Router and Server Actions.
  • Default configuration, no custom dangerous code, intentionally left unpatched.
  • Designed to study insecure deserialization in the RSC “Flight” protocol and to practice detection/mitigation.

Quick start (Docker recommended)

root@kitploit:~
# 1. Start the lab
docker-compose up -d

# 2. Open the app
http://localhost:3000

# 3. Stop when done
docker-compose down

Manual setup and dev mode

Production-like manual run:

root@kitploit:~
npm install --legacy-peer-deps
npm run build
npm start
# Visit http://localhost:3000

Development with hot reload:

root@kitploit:~
npm install --legacy-peer-deps
npm run dev

Notes:

  • Always use --legacy-peer-deps because of intentional version pinning.
  • If port 3000 is busy, change the mapping in docker-compose.yml (e.g., 3001:3000) or export PORT before starting.

Quick operational status

  • Container: hi-react2shell-tribune
  • Port: 3000 (expects HTTP 200 OK)
  • Vulnerable versions: React 19.0.0, Next.js 15.0.3

Helpful commands:

root@kitploit:~
docker-compose ps
docker-compose logs -f hi-react2shell-tribune
docker-compose restart
docker-compose build --no-cache && docker-compose up -d

Vulnerability summary (React2Shell)

  • CVE-2025-55182 (React) and CVE-2025-66478 (Next.js) allow unauthenticated RCE via insecure deserialization in RSC.

Relevant affected versions:

  • React: 19.0.0, 19.1.0, 19.1.1, 19.2.0
  • Next.js: >=14.3.0-canary.77, all 15.x, 16.x unpatched

Exploitation reality

  • No publicly known RCE exploit for a default app; react2shell.com says “Watch this space.”
  • PoCs that manually expose child_process, vm, or fs are not representative.

References

  • Vercel/Next.js Advisory: https://github.com/vercel/next.js/security/advisories/GHSA-9qr9-h5gf-34mp
  • React2Shell info hub: https://react2shell.com/
  • Wiz analysis: https://www.wiz.io/blog/critical-vulnerability-in-react-cve-2025-55182

License

This project is licensed under the Apache License 2.0. See LICENSE for details.

Credits

  • Main contributor: @sakibulalikhan
  • Build with ❤️ by HiddenInvestigations.Net

📬 Contact us: [email protected]

Download Tool