React2Shell Checker

A security vulnerability scanner for detecting the React2Shell vulnerability (CVE-2025-55182) in Next.js and React applications.

Overview

React2Shell Checker allows you to scan websites to detect if they are running vulnerable versions of Next.js or React Server Components. The tool uses headless browser technology to detect framework versions and compares them against known vulnerable version ranges.

Features

• 🔍 Automatic Detection — Detects Next.js and React versions using browser-based analysis
• ⚠️ Vulnerability Assessment — Checks against official affected version lists
• 📋 Detailed Reports — Shows framework, version, severity, and remediation steps
• 🔗 Official References — Links to Vercel and React security advisories
• 📱 Responsive UI — Works on desktop and mobile devices

Getting Started

Prerequisites

• Node.js 20+
• npm or yarn
• A Puppeteer-compatible browser endpoint (for version detection)

Installation

# Clone the repository
git clone https://github.com/muthaiyanmani/react2shell-checker.git
cd react2shell-checker

# Install dependencies
npm install

Environment Variables

Create a .env.local file in the root directory:

# Required: Puppeteer browser WebSocket endpoint
BROWSER_WS_ENDPOINT=wss://your-browser-endpoint

Development

# Start development server
npm run dev

# Run linting
npm run lint

# Format code
npx prettier --write .

Production Build

# Build for production
npm run build

# Start production server
npm start

Affected Versions

Next.js

React RSC

Security Considerations

• Authorized Use Only — Only scan websites you own or have permission to test
• No Data Storage — The tool does not store scanned URLs or results
• Public Information — All vulnerability data is sourced from official public advisories

Official References

• Vercel Security Bulletin - React2Shell
• React Security Advisory

License

MIT License - See LICENSE for details.

Disclaimer

This tool is provided "AS IS" without warranty of any kind. The developers assume no liability for any damages arising from use of this tool. Results are based on publicly available information and should be verified by a qualified security professional.

Not affiliated with Vercel, Next.js, or React.

Author: Muthaiyan Mani

For educational and security research purposes only.