CVE-2025-55182 – Local RCE Lab (React Server Components)

This repository is a small local lab to understand how CVE-2025-55182 works in practice on a deliberately vulnerable React Server Components / Next.js application.

It is meant for education, blue teaming and secure development awareness only.

For the full write-up and background, see:
https://medium.com/@terwaljoop/cve-2025-55182-how-this-rce-works-in-the-real-world-b7d0564e5466

Disclaimer

• This code is for learning and testing in a local environment only
• Do not point this PoC at systems you do not own or have explicit permission to test
• The goal is to understand the attack path and improve defenses, not to attack real targets

By using this lab you accept that you are responsible for your own actions.

Repository structure

vulreactapp/
├─ vuln-app-CVE-2025-55182/   # Vulnerable Next.js / RSC app
│  ├─ app/
│  ├─ curl_id.sh              # Helper script to trigger RCE in the lab
│  ├─ next.config.js
│  ├─ package.json
│  ├─ package-lock.json
│  └─ ...
└─ react2shell-scanner/       # Optional scanner helper (nuclei etc.)
   ├─ list.txt
   ├─ scan.yaml
   ├─ scanner.py
   └─ ...