hualy13/cve-2025-55182Automated proof-of-concept exploit for Next.js RCE (CVE-2025-55182) with interactive shell, batch scanning, and advanced payload encoding for security research and authorized penetration testing.
This is an automated Proof-of-Concept (PoC) tool for the Next.js React Server Components (CVE-2025-55182) Remote Code Execution (RCE) vulnerability.
The tool integrates an interactive Shell, intelligent protocol detection, and multi-threaded batch scanning capabilities, designed for security researchers and penetration testers to quickly verify and exploit this vulnerability.
⚠️ Disclaimer: This tool is intended solely for cybersecurity education and authorized security testing. It is strictly prohibited to use it for any unauthorized attacks. Users assume all legal responsibilities arising from the use of this tool.
192.168.1.1, example.com, or URLs without protocols). The tool will attempt HTTPS first and automatically fall back to HTTP upon failure.ls -F or reading non-text files).base64 or tr commands on the target system (perfectly adapted for Alpine/Distroless and other minimal container environments).Clone the repository:
git clone https://github.com/hualy13/CVE-2025-55182.git
cd CVE-2025-55182
Install dependencies:
pip install -r requirements.txt
Connect to the target like SSH, supporting continuous command execution.
python CVE-2025-55182.py -u [https://target.com/apps] --shell
Note: If you enter an IP (e.g. 127.0.0.1), the tool will automatically attempt HTTPS connection first.
Load a list of targets from a text file for batch detection.
Bash
python CVE-2025-55182.py -f targets.txt -t 20
-f: Path to the target list file (one target per line).-t: Number of scanning threads (default is 10).success.txt file in the current directory.Execute one command and exit, suitable for quick verification.
Bash
python CVE-2025-55182.py -u [https://target.com/apps] -c "id"
Supports configuring an HTTP/HTTPS proxy (e.g., to use with Burp Suite for packet analysis).
Bash
python CVE-2025-55182.py -u [https://target.com/apps] --shell -p [http://127.0.0.1:8080]
The targets.txt file supports mixed formats; the tool will automatically normalize them:
Plaintext
192.168.1.100 # Automatically attempts [http://192.168.1.100]
10.0.0.5:3000 # Automatically attempts [http://10.0.0.5:3000]
example.com # Attempts [https://example.com] first, falls back to http://
[https://site.com/apps] # Tests as-is
This vulnerability exploits unsafe deserialization of payloads in Next.js Server Actions. This tool constructs a malicious JSON payload; the execution flow is as follows:
child_process.execSync call.try-catch block to prevent a server 500 error if the command does not exist or fails.Buffer to convert the command execution result to a Base64 string.X-Action-Redirect or Location) and returned to the attacker.The tools and information provided in this repository are intended solely for security research and authorized testing. The author is not responsible for any illegal actions or losses caused by misuse of this tool.
Do not test any system without explicit authorization.