Skip to content
KitploitKITPLOIT
ToolsBlog
Submit
ToolsBlog
Submit

Hacking, PenTest, and Cybersecurity Tools for Your Security Arsenal!

Kitploit is a directory of hacking, cybersecurity, and pentesting tools. Discover the latest project updates to find vulnerabilities, analyze systems, automate testing, and strengthen your security.

··Feeds·Contact·Privacy·© 2026 Kitploit

Tool Directory

Categories

View all categories
Loading categories
CVE-2025-55182-TOOLS — A Comprehensive CVE-2025-55182 Detection and Security Assessment Tool | Kitploit
Tools/GitHubGitHub/mingyisecurity-lab/cve-2025-55182-tools
Vulnerability ScannersVulnerability AnalysisExploitationWeb Application ExploitationPenetration TestingRemote Access Tool
GitHubmingyisecurity-lab/cve-2025-55182-tools

CVE-2025-55182-TOOLS

A Comprehensive CVE-2025-55182 Detection and Security Assessment Tool

View Repository
239 months agoNot yet reviewed

Most Popular

View all →

Discover the most used tools by our community.

Explore all tools

Browse our collection of tools

View all tools →
Share

CVE-2025-55182 Exploit Tool

CVE-2025-55182 Comprehensive Exploitation/Detection Tool

Developed by MingYi Security Lab

Screenshot

Features

  • Vulnerability Detection: Batch scan multiple targets for the vulnerability
  • Path Scanning: Scan common Server Action endpoints to discover vulnerable paths
  • Remote Code Execution: Execute system commands on vulnerable targets
  • Multiple Exploit Methods:
    • V1: vm#runInThisContext - Classic RCE method
    • V2: $@ Chunk.prototype.then - Advanced POC for Next.js 16.0.6+

Installation

root@kitploit:~
go build -o cve-tool main.go

Usage

root@kitploit:~
./cve-tool

Keyboard Shortcuts

KeyAction
TabSwitch between input fields
Shift+TabPrevious input field
F1 / Ctrl+1Detection tab
F2 / Ctrl+2Path Scan tab
F3 / Ctrl+3Exploit tab
EnterExecute current action
Ctrl+QQuick commands (Exploit tab)
Ctrl+ESwitch exploit method (Exploit tab)
EscExit

Tabs

  1. Detection: Scan one or multiple targets for the vulnerability
  2. Path Scan: Discover vulnerable endpoints on a single target
  3. Exploit: Execute commands on confirmed vulnerable targets

Default Path Dictionary

The tool includes common Server Action paths:

  • /, /formaction, /action, /actions
  • /api/action, /api/actions, /api/form, /api/submit
  • /submit, /form, /rsc, /_rsc
  • /_next/forms, /server-action, /server-actions

Exploit Methods

V1: vm#runInThisContext

Classic RCE method using vm#runInThisContext to execute arbitrary JavaScript code.

V2: $@ Chunk.prototype.then (Next.js 16.0.6+)

Advanced POC that uses $@ deserialization to get a Chunk reference and sets Chunk.prototype.then as the then property of the root object. This triggers Blob deserialization with Function constructor for RCE.

Core idea:

  1. Use $@ deserialization to get a Chunk reference
  2. Set Chunk.prototype.then as the then property
  3. When awaited/resolved, then is invoked with the root object as this
  4. Set status to RESOLVED_MODEL to call initializeModelChunk with a fake chunk
  5. Trigger Blob deserialization which calls response._formData.get with attacker-controlled payload

Disclaimer

This tool is for authorized security testing only. Unauthorized access to computer systems is illegal.

License

Copyright © 2025 MingYi Security Lab. All rights reserved.

Download Tool