Skip to content
KitploitKITPLOIT
ToolsBlog
Submit
ToolsBlog
Submit

Hacking, PenTest, and Cybersecurity Tools for Your Security Arsenal!

Kitploit is a directory of hacking, cybersecurity, and pentesting tools. Discover the latest project updates to find vulnerabilities, analyze systems, automate testing, and strengthen your security.

··Feeds·Contact·Privacy·© 2026 Kitploit

Tool Directory

Categories

View all categories
Loading categories
CVE-2025-55182 — Proof-of-concept exploit for CVE-2025-55182, an unsafe deserialization vulnerability in React Server Components enabling unauthenticated remote code execution via crafted payloads. | Kitploit
Tools/GitHubGitHub/robbin0919/cve-2025-55182
Vulnerability AnalysisExploitationWeb Application ExploitationPenetration TestingLearning & EducationPayload Development
GitHubrobbin0919/cve-2025-55182

CVE-2025-55182

Proof-of-concept exploit for CVE-2025-55182, an unsafe deserialization vulnerability in React Server Components enabling unauthenticated remote code execution via crafted payloads.

View Repository
39 months agoNot yet reviewed

Most Popular

View all →

Discover the most used tools by our community.

Explore all tools

Browse our collection of tools

View all tools →
Share

CVE-2025-55182: React Server Components Unsafe Deserialization Vulnerability

Overview

CVE-2025-55182 (also known as React2Shell) is a critical unsafe deserialization vulnerability discovered in the React Flight Protocol, affecting the payload of React Server Components (RSC). This vulnerability resides in the react-server package.

Key Information

  • CVE ID: CVE-2025-55182
  • Vulnerability Type: Unsafe Deserialization
  • Affected Components:
    • React Flight Protocol
    • React Server Components (RSC)
    • react-server package
  • Affected Versions:
    • React Server Components 19.0.0, 19.1.0, 19.1.1, 19.2.0
    • Packages including react-server-dom-parcel, react-server-dom-turbopack, react-server-dom-webpack
  • Next.js 15.x/16.x versions using App Router
  • Impact: Unauthenticated Remote Code Execution (RCE). An attacker can send a malicious payload to execute arbitrary code when the server processes it.
  • Severity: Critical
    • CVSS Score: 10.0 (maximum)
  • Exploitation Status:
    • Exploitable in default configurations of multiple popular frameworks, including Next.js, React Router, and Waku.
    • Proof-of-concept (PoC) code is publicly available.
    • Reports indicate active scanning in the wild, with exploitation by China-linked cyber threat groups.
  • Disclosure Timeline:
    • Discoverer: Lachlan Davidson
    • Disclosed to React Team: November 29, 2025
    • Public Disclosure: December 3, 2025
  • Mitigation:
    • Immediate Patching: All developers using React Server Components are strongly advised to upgrade affected packages to patched versions immediately.
    • CISA: This CVE has been added to the U.S. Cybersecurity and Infrastructure Security Agency's (CISA) Known Exploited Vulnerabilities Catalog.
    • No Workaround: No known temporary workaround is available.

    • References

    • This PoC implementation mainly references the following materials:
      • l4rm4nd/CVE-2025-55182
      • Malayke/Next.js-RSC-RCE-Scanner-CVE-2025-66478
      • zack0x01/vuln-app-CVE-2025-55182 - Complete PoC process and tutorial
    Download Tool