
A Comprehensive CVE-2025-55182 Detection and Security Assessment Tool
CVE-2025-55182 Comprehensive Exploitation/Detection Tool
Developed by MingYi Security Lab

vm#runInThisContext - Classic RCE method$@ Chunk.prototype.then - Advanced POC for Next.js 16.0.6+go build -o cve-tool main.go
./cve-tool
| Key | Action |
|---|---|
Tab | Switch between input fields |
Shift+Tab | Previous input field |
F1 / Ctrl+1 | Detection tab |
F2 / Ctrl+2 | Path Scan tab |
F3 / Ctrl+3 | Exploit tab |
Enter | Execute current action |
Ctrl+Q | Quick commands (Exploit tab) |
Ctrl+E | Switch exploit method (Exploit tab) |
Esc | Exit |
The tool includes common Server Action paths:
/, /formaction, /action, /actions/api/action, /api/actions, /api/form, /api/submit/submit, /form, /rsc, /_rsc/_next/forms, /server-action, /server-actionsClassic RCE method using vm#runInThisContext to execute arbitrary JavaScript code.
Advanced POC that uses $@ deserialization to get a Chunk reference and sets Chunk.prototype.then as the then property of the root object. This triggers Blob deserialization with Function constructor for RCE.
Core idea:
$@ deserialization to get a Chunk referenceChunk.prototype.then as the then propertythen is invoked with the root object as thisRESOLVED_MODEL to call initializeModelChunk with a fake chunkresponse._formData.get with attacker-controlled payloadThis tool is for authorized security testing only. Unauthorized access to computer systems is illegal.
Copyright © 2025 MingYi Security Lab. All rights reserved.