Skip to content
KitploitKITPLOIT
ToolsBlog
Submit
ToolsBlog
Submit

Hacking, PenTest, and Cybersecurity Tools for Your Security Arsenal!

Kitploit is a directory of hacking, cybersecurity, and pentesting tools. Discover the latest project updates to find vulnerabilities, analyze systems, automate testing, and strengthen your security.

··Feeds·Contact·Privacy·© 2026 Kitploit

Tool Directory

Categories

View all categories
Loading categories
CVE-2025-55182-NextJS-RCE-PoC — Working Proof of Concept (PoC) for CVE-2025-55182 (React2Shell) - Unauthenticated Remote Code Execution in Next.js 15.0.0 via React Server Components | Kitploit
Tools/GitHubGitHub/pkrasulia/cve-2025-55182-nextjs-rce-poc
Vulnerability AnalysisExploitationWeb Application ExploitationLearning & EducationPayload DevelopmentLabs & Practice
GitHubpkrasulia/cve-2025-55182-nextjs-rce-poc

CVE-2025-55182-NextJS-RCE-PoC

Working Proof of Concept (PoC) for CVE-2025-55182 (React2Shell) - Unauthenticated Remote Code Execution in Next.js 15.0.0 via React Server Components

View Repository
4139 months agoNot yet reviewed

Most Popular

View all →

Discover the most used tools by our community.

Explore all tools

Browse our collection of tools

View all tools →
Share

CVE-2025-55182 (React2Shell) Reproduction Environment

⚠️ EDUCATIONAL PURPOSE ONLY

This repository is created strictly for educational and research purposes. It demonstrates a critical vulnerability in React Server Components (Next.js) to help developers understand the risks and importance of updating their dependencies.

DO NOT USE THIS CODE IN PRODUCTION OR AGAINST SYSTEMS YOU DO NOT OWN.

Overview

This project reproduces CVE-2025-55182 (also known as "React2Shell"), a Remote Code Execution (RCE) vulnerability affecting React Server Components in Next.js applications.

  • Vulnerability: Unauthenticated RCE via Prototype Pollution in RSC parser.
  • Affected Versions: React < 19.0.0 (specifically experimental builds), Next.js < 15.0.3 (specifically 15.0.0 in this demo).
  • Mechanism: The attacker sends a crafted multipart/form-data request that exploits the deserialization logic of React Server Components to execute arbitrary JavaScript code on the server.

Demo of CVE-2025-55182 RCE

Project Structure

  • app/page.js: Contains the . This Client Component allows you to run RCE commands directly from the browser.
Interactive Exploit Dashboard
  • app/actions.js: Contains a standard Server Action. The vulnerability lies in the framework's parsing logic before this action is executed.
  • exploit.js: A standalone Node.js script to demonstrate the exploit programmatically.

    • Setup & Installation

    Prerequisites

    • Node.js (v18 or later recommended)
    • NPM
    • (Optional) nvm for version management

    Installation

    1. Clone the repository:

      root@kitploit:~
      git clone https://github.com/pkrasulia/CVE-2025-55182-NextJS-RCE-PoC.git
cd react-cve-test

    2. (Optional) Use the correct Node.js version:

      root@kitploit:~
      nvm use

    3. Install dependencies (this will install the vulnerable versions):

      root@kitploit:~
      npm ci --legacy-peer-deps
# OR
npm install --force

    4. Start the development server:

      root@kitploit:~
      npm run dev

    The server should start on http://localhost:3000.

    How to Reproduce RCE

    Method 1: Interactive Dashboard (Recommended)

    1. Open http://localhost:3000 in your browser.
    2. You will see the "CVE-2025-55182 Demo" page.
    3. In the Attacker Panel, enter a command (e.g., whoami, ls -la, or cat package.json).
    4. Click SEND EXPLOIT.
    5. Observe the command output in the Attack Terminal on the right.

    Method 2: Command Line (Node.js)

    You can run the exploit script directly from your terminal:

    root@kitploit:~
    # Basic usage
node exploit.js http://localhost:3000 "whoami"

# Open Calculator (Linux) - use '&' to run in background
node exploit.js http://localhost:3000 "gnome-calculator &"

    Mitigation

    To fix this vulnerability in your own projects:

    1. Update Next.js: Upgrade to Next.js 15.0.3 or later.
      root@kitploit:~
      npm install next@latest react@latest react-dom@latest
    2. Audit Dependencies: Ensure no other packages are forcing older versions of React/Next.js.

    Disclaimer

    The author is not responsible for any misuse of this information. This project is intended to help security researchers and developers improve the security of their applications.

    Download Tool