CVE-2025-55182 — demo

This repository provides a demonstration of the CVE-2025-55182 vulnerability, which allows for remote code execution (RCE) in vulnerable Next.js applications.

References:

• CVE entry: https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2025-55182
• Related PoC: https://github.com/msanft/CVE-2025-55182

[!WARNING] This demonstration is provided for security research, testing, and educational purposes only. Do not use it against systems for which you do not have explicit authorization.

Getting Started

Prerequisites

• Docker and Docker Compose installed and running.
• Python 3.8+ with venv support.

[!NOTE] Run the commands from the root folder unless otherwise noted.

Start the vulnerable Next.js application

From the project root, run:

docker compose -f nextjs-target/compose.yml up --build -d

By default the application is served at http://localhost:3000.

Run the exploit script

1. Create and activate a Python virtual environment:

   python3 -m venv .venv
   source .venv/bin/activate    # macOS / Linux
   # .venv\Scripts\activate    # Windows (PowerShell/CMD)
   

2. Install dependencies:

   pip install -r requirements.txt
   

3. Run the PoC (replace HOST/PORT/ENDPOINT as appropriate):

   python exploit.py --host 127.0.0.1 --port 3000 --endpoint /
   

[!WARNING] The script demonstrates command execution against a vulnerable target. Use it only on systems where you have explicit permission to test.

Examples

Common commands to run on a permitted test target (examples only):

ls -la
env

Stopping the target app

Stop and remove containers:

docker compose -f nextjs-target/compose.yml down