React2Shell Exploit

Proof of Concept (PoC) for React Server Components (RSC) / Next.js Remote Code Execution vulnerability.

Description

A pre-authentication remote code execution vulnerability exists in React Server Components versions 19.0.0, 19.1.0, 19.1.1, and 19.2.0 including the following packages: react-server-dom-parcel, react-server-dom-turbopack, and react-server-dom-webpack. The vulnerable code unsafely deserializes payloads from HTTP requests to Server Function endpoints.

Disclaimer

⚠️ WARNING: This tool is for authorized security testing only.

• Only use this tool on systems you own or have explicit written permission to test
• Unauthorized access to computer systems is illegal
• Testing is your own responsibility
• The authors are not responsible for any misuse or damage

Requirements

• Go 1.16 or higher

Installation

go build -o exploit exploit.go

Or run directly:

go run exploit.go

Usage

./exploit -u <URL> -c <command>

Options

• -u - Target URL (required)
• -c - Command to execute (default: id)

Examples

# Basic usage
./exploit -u https://vulnerable -c "whoami"

# Execute different command
./exploit -u https://vulnerable -c "ls -la"

# Run directly with go
go run exploit.go -u https://vulnerable -c "pwd"

Screenshot

Output

The tool outputs:

• HTTP status code
• Command execution output (if successful)

References

• FortiGuard Threat Signal Report - React2Shell RCE Vulnerability
• CVE-2025-55182 - NVD