CVE-2025-55182

Vulnerable Application

Build and run:

docker compose build
docker compose run --rm --entrypoint 'npm install' node
docker compose run --rm --entrypoint 'npm run build' node
docker compose up

POC (from https://github.com/msanft/CVE-2025-55182):

node poc.js

Experimentation with unbundled:

yarn --immutable

node --conditions react-server app.js

CodeQL

Clone facebook/react and create unbundled:

yarn --immutable

yarn cross-env RELEASE_CHANNEL=experimental node ./scripts/rollup/build.js react-server-dom-webpack/ --type=NODE_DEV

cp ./build/node_modules/react-server-dom-webpack/cjs/react-server-dom-webpack-server.node.unbundled.development.js \
    codeql/${version}/

Prepare CodeQL:

codeql database create db -l javascript -s codeql

cd queries && codeql pack install

codeql query run ./queries/PrototypeTraversal.ql -d db

TODO

Add a query to find Promise.resolve(userData)
- should find all async functions that resolve with a user defined object
- this is the immediate location of code execution problems
Add a query to find await non-native-promise
- should find all await of functions that do not return a native promise
- a caller might erroneously use await on a method that (sometimes) returns raw data

Results

It caught the patched usage in getOutlinedModel (added hasOwnProperty.call) and the removed one in createModelResolver (now fulfillReference).

I don't know why the first and second one point to the same location, while the extracted one in vuln.js does not.

Examples

In codeql/tests.js there are these three variants:

var value = {};
for (let i = 0; i < path.length; i++) {
  value = value[path[i]] // VarAccess
}

var value = {};
for (let i = 0; i < path.length; i++) {
  let c = value[path[i]] // VarDecl
  value = c
}

var value = {};
for (let i = 0; i < path.length; i++) {
  let c
  c = value[path[i]] // use VarRef
  value = c
}

Reference: https://codeql.github.com/docs/codeql-language-guides/abstract-syntax-tree-classes-for-working-with-javascript-and-typescript-programs/

./19.2.0/react-server-dom-webpack-server.node.unbundled.development.js	parentObject[reference[key]]	parentObject[reference[key]]	Unsafe prototype traversal: Variable 'parentObject' is updated with its own property inside a loop.
./19.2.0/react-server-dom-webpack-server.node.unbundled.development.js	parentObject[reference[key]]	parentObject[reference[key]]	Unsafe prototype traversal: Variable 'parentObject' is updated with its own property inside a loop.
./19.2.0/react-server-dom-webpack-server.node.unbundled.development.js	value[path[i]]	value[path[i]]	Unsafe prototype traversal: Variable 'value' is updated with its own property inside a loop.
./tests.js	value[path[i]]	c	Unsafe prototype traversal: Variable 'value' is updated with its own property inside a loop.
./tests.js	value[path[i]]	c	Unsafe prototype traversal: Variable 'value' is updated with its own property inside a loop.
./tests.js	value[path[i]]	value[path[i]]	Unsafe prototype traversal: Variable 'value' is updated with its own property inside a loop.
./vuln.js	parentObject[reference[key]]	parentObject[reference[key]]	Unsafe prototype traversal: Variable 'parentObject' is updated with its own property inside a loop.
./vuln.js	value[path[i]]	value[path[i]]	Unsafe prototype traversal: Variable 'value' is updated with its own property inside a loop.

CVE-2025-55182

Most Popular

CVE-2025-55182

Vulnerable Application

CodeQL

TODO

Results

Examples