React2Shell Vulnerability Lab

This is a deliberately vulnerable Next.js application for testing CVE-2025-55182 and CVE-2025-66478 (React Server Components RCE).

⚠️ WARNING: This application is intentionally vulnerable. Use only in isolated lab environments.

Vulnerability Details

• CVE-2025-55182 / CVE-2025-66478: Remote Code Execution in Next.js React Server Components
• Affected Versions: Next.js with React Server Components and Server Actions enabled
• Attack Vector: Malicious RSC payload manipulation via Server Actions endpoint

This lab includes:

• Next.js 15.0.3 with React 19.0.0-rc-66855b96-20241106 (vulnerable versions)
• No security mitigations applied

Getting Started

Running with Docker (Recommended)

1. Build the Docker image:

   root@kitploit:~

   docker build -t react2shell-lab .
   

2. Run the container:

   root@kitploit:~

   docker run -p 3000:3000 --name react2shell-lab react2shell-lab
   

3. Access the application: Open http://localhost:3000 in your web browser.

Running Locally

First, install dependencies:

npm install

Then run the development server:

npm run dev

Open http://localhost:3000 with your browser to see the result.

Security Notes

• This is a lab environment only
• Never deploy this to production
• Use in isolated Docker containers or VMs
• For educational and authorized security testing only

Learn More

About the vulnerabilities:

• CVE-2025-55182 Details
• React Server Components Security

About Next.js:

To learn more about Next.js, take a look at the following resources:

• Next.js Documentation - learn about Next.js features and API.
• Learn Next.js - an interactive Next.js tutorial.