CVE-2025-55182-React2Shell-RCE-POC

CVE-2025-55182 - React2Shell RCE

This repository documents research into CVE-2025-55182, also known as React2Shell, a critical unsafe deserialization vulnerability in React Server Components (RSC) and frameworks that embed the RSC Flight protocol, especially Next.js App Router.

The focus here is on how malformed RSC / Flight payloads combined with Server Function (Server Action) handling can lead to execution of attacker-controlled JavaScript on the server.

This material is for defensive understanding, controlled lab reproduction, and documentation. It is not a ready exploit toolkit. Only test against systems you own or have explicit written authorization to assess.

---

Affected Software and Versions

React RSC (CVE-2025-55182)

The core bug is in the server-side RSC Flight implementation. It affects the following npm packages and versions:

Vulnerable packages and versions (Vulert)

• react-server-dom-webpack

  • 19.0.0
  • 19.1.0
  • 19.1.1
  • 19.2.0

• react-server-dom-parcel

  • 19.0.0
  • 19.1.0
  • 19.1.1
  • 19.2.0

• react-server-dom-turbopack

  • 19.0.0
  • 19.1.0
  • 19.1.1
  • 19.2.0

Patched versions (per React advisory) (Vulert)

• 19.0.1
• 19.1.2
• 19.2.1

Any application using React 19 with RSC and one of the vulnerable packages should be treated as affected until upgraded, even if it does not explicitly define Server Functions.

---

Next.js (CVE-2025-66478)

Next.js inherits the vulnerable RSC implementation when using the App Router. The issue is tracked as CVE-2025-66478 for Next.js and is also rated CVSS 10.0. (SOCRadar® Cyber Intelligence Inc.)

Vulnerable Next.js versions (App Router)

• All builds using React 19 RSC with:

  • next 15.x prior to:

    • 15.0.5
    • 15.1.9
    • 15.2.6
    • 15.3.6
    • 15.4.8
    • 15.5.7

  • next 16.x prior to 16.0.7

  • Canary builds starting from 14.3.0-canary.77 and later canary releases before fixes

In practice this means:

• Next.js 15 and 16 with the App Router are affected until they reach the above fixed versions.
• Default create-next-app projects that use the App Router and React 19 are in scope unless updated.

Not affected in this CVE (per vendor guidance) (Black Kite)

• Next.js Pages Router applications
• Stable Next.js 13 and 14 that do not use the React 19 RSC stack
• Edge Runtime and purely client-side React without server components

---

Other Frameworks and Ecosystems

Any framework or bundler that ships the vulnerable RSC packages can be affected. Currently listed ecosystems include: (Vulert)

• React Router RSC preview builds
• RedwoodJS / Redwood SDK using RSC
• Waku
• @parcel/rsc
• @vitejs/plugin-rsc
• Other RSC integrations built on React 19

If a stack uses React 19 plus one of the vulnerable react-server-dom-* packages, assume it is affected until proven otherwise.

---

Exploitation Conditions

Based on public advisories and vendor writeups, exploitation has the following characteristics: (Vulert)

• Authentication

  • Unauthenticated in typical deployments
  • No valid user session is required if the Server Function endpoint is publicly reachable

• Configuration

  • React 19 with RSC enabled and using a vulnerable react-server-dom-* package
  • An exposed Server Function or Server Action endpoint that processes RSC Flight payloads
  • In Next.js, use of the App Router with React 19 in the vulnerable version ranges
  • No need for developers to define explicit dangerous server functions such as child_process.exec themselves

• Network exposure

  • Any HTTP(S) endpoint that accepts RSC Flight requests can be targeted
  • Cloud scanning suggests a large portion of public internet-facing Next.js RSC endpoints are in scope (CyberInsider)

• Attack flow (high level)

  • Send a single crafted HTTP request to a Server Function endpoint
  • The request carries a malformed Flight payload that breaks RSC deserialization invariants
  • Unsafe decoding allows attacker-controlled data to be treated as executable JavaScript on the server
  • Result is arbitrary code execution in the Node.js process under application privileges

CVSS 3.1 assessments describe this as:

• Attack Vector: Network
• Attack Complexity: Low
• Privileges Required: None
• User Interaction: None
• Scope: Changed
• Impact: High on confidentiality, integrity, and availability (0xpthree.gitbook.io)

---

Summary of Observed Behavior in Labs

In controlled testing environments, using vulnerable versions and RSC-enabled configurations, researchers and vendors report: (SOCRadar® Cyber Intelligence Inc.)

• High reliability of exploit attempts when a correctly targeted Server Function endpoint is used
• Successful execution of attacker supplied JavaScript within the React RSC server context
• Ability to chain this into arbitrary command execution via standard Node.js primitives in proof-of-concept research
• Full compromise of application data and environment variables once code execution is achieved