React2Shell-PoC

A proof-of-concept exploit for CVE-2025-55182 and CVE-2025-66478, critical Remote Code Execution vulnerabilities in React Server Components (RSC) and Next.js applications.

Overview

React2Shell demonstrates the exploitation of unsafe deserialization in Next.js server action handlers, allowing unauthenticated attackers to execute arbitrary commands on vulnerable servers through specially crafted multipart form-data payloads.

Tools

• scanner.py - Vulnerability scanner by Assetnote for detecting vulnerable Next.js/RSC instances across multiple hosts
• main.py - Direct RCE exploit for executing commands on vulnerable targets

Quick Start

Scanning

Scan a single host:

python3 scanner.py -u https://target.com

Scan multiple hosts from a file:

python3 scanner.py -l targets.txt -t 20 -o results.json

Exploitation

Execute a command on a vulnerable host:

python3 main.py target.com 'id'

Execute commands from a list of vulnerable hosts:

python3 main.py -l vulnerable.txt 'whoami'

CVE Details

• CVE-2025-55182: Next.js Server Action RCE via Prototype Pollution
• CVE-2025-66478: React Server Component Deserialization RCE

Disclaimer

This tool is provided for educational and authorized security testing purposes only. Unauthorized access to computer systems is illegal.