React2Shell (CVE-2025-55182)

Overview

This repository is my research on CVE-2025-55182, also referred to as React2Shell vulnerability. Repo consists of two main part: stand and exploit.

References

Some info about this security flaw:

• NIST
• HackerOne article
• Summary by Vercel
• Article by WIZ
• Author webpage
• Original PoC

Root cause

The vulnerability is basically a lack of user input validation. But it's not that simple =)

React Client part and React Server part use a React Flight Protocol, to exchange data. Here is a good talk about it, for you to get familiar with it quickly.

Example of React Flight Protocol massage chunks:

{
    "0": (None, '["$1"]'),
    "1": (None, '{"object":"fruit","name":"$2:fruitName"}'),
    "2": (None, '{"fruitName":"cherry"}'),
}

Chunks of RFP, can refer to each other using the $ operator. When chunks, later, get deserialized on server, this links are resolved. A key things here is that, we can access the object prototype from it.

By manipulating the prototype, we can force the V8 to await our .then(). The result payload may look like this:

{
    "then": "$1:__proto__:then",
    "status": "resolved_model",
    "reason": -1,
    "value": '{"then": "$B0"}',
    "_response": {
        "_prefix": f"return foo; ",
        "_formData": {
            "get": "$1:constructor:constructor",
        },
    },
}

I will not get too deep into details of how actually this gadget chain works, if you want to know more about it, read a great analyze here by Moritz Sanft.

You can also see the github version comparison, before and after patch, if you want to dig deeper into this flaw.

Stand

I've create a simple react/next.js app, that uses(see the stand/package.json):

"dependencies": {
  "next": "16.0.6",
  "react": "19.2.0",
  "react-dom": "19.2.0"
},

Just a simple page with text content, created with create-next-app:

In order to start, run this in stand directory:

docker compose up --build -d

Then navigate to http://localhost:3000 in you browser.

Exploit

Exploitation is straight forward. We just need to send a specially constructed RFP chunks with our payload to server with Post request. See the exploit/src/main.py. It also includes a simple check if server vulnerable or not, it tries to run a whoami command, if is timeout exceeds, server is most likely uses patched version.

You can see the RFP payload in exploit/resource/chunk.json.

Before running exploit, don't forget setup netcat listener and update the exploit/resource/config.toml with your host and port, in order to get a reverse shell.

Happy pwning!

Creds

Big respect to Lachlan Davidson, who discovered a vulnerability, maple who found a good gadget, and also Moritz Sanft, who shared his PoC who wrote a great analyze.

prod by I3r1h0n.