• react-server-dom-parcel
• react-server-dom-turbopack
• react-server-dom-webpack

Impact: Unauthenticated attackers can execute arbitrary code remotely through unsafe deserialization of HTTP request payloads to Server Function endpoints.

📚 Want to Understand This Vulnerability Completely?

👉 Read the Complete Technical Analysis - A comprehensive guide covering:

• ✅ Why React runs on the server (not just the browser!)
• ✅ What are Server Components and how they work
• ✅ Step-by-step attack flow with visual diagrams
• ✅ Complete payload breakdown - every line explained
• ✅ Prototype pollution explained from basics to exploitation
• ✅ Real-world proof of concept with examples
• ✅ Detection methods and security indicators

Perfect for:

• 🎓 Learning how modern web vulnerabilities work
• 🔒 Security professionals doing threat analysis
• 👨‍💻 Developers wanting to understand the risk
• 📊 Creating security reports and presentations

No prior knowledge required - starts from basics and builds up to advanced exploitation techniques!

⚠️ Legal Disclaimer

FOR EDUCATIONAL AND AUTHORIZED SECURITY TESTING ONLY

This tool is intended solely for:

• Security research
• Authorized penetration testing
• Educational purposes

Warning: Unauthorized access to computer systems is illegal. Users are responsible for complying with all applicable laws and regulations. The authors assume no liability for misuse of this tool.

🎯 Quick Start Options

Option 1: Standalone Exploit Script (Fastest)

No dependencies required! Single bash script for quick testing.

👉 EXPLOIT_SCRIPT.md - Standalone script that:

• ✅ Tests vulnerability with one command
• ✅ Provides interactive shell
• ✅ Works without Nuclei or Docker
• ✅ Supports single or multiple targets

Option 2: Full Scanner Suite (Most Features)

Complete toolkit with Docker, Web UI, and Nuclei integration. Continue reading below for installation.

🚀 Features

📋 Prerequisites

Choose your installation method:

Docker (Recommended)

• Docker Desktop installed and running

Local Installation

• Node.js 18+ (for vulnerable app)
• Nuclei scanner (install via Homebrew or Go)
• macOS, Linux, or Windows with WSL2

🛠️ Installation

Quick Start with Docker

Local Installation

📖 Detailed Setup: See SETUP_GUIDE.md for step-by-step instructions
⚡ Quick Reference: See QUICKSTART.md for common use cases

📖 Usage

🐳 Docker Mode

Start Web Interface:

Start with Vulnerable Test App:

Important for Docker users: When scanning from Docker, use:

• http://host.docker.internal:3000 to scan apps on your host machine
• http://vulnerable-app:3000 to scan the containerized vulnerable app
• https://example.com for external targets

🌐 Web Interface

1. Navigate to http://localhost:3001
2. Select mode:
   • Vulnerability Detection - Check if target is vulnerable
   • Command Execution - Execute OS commands on vulnerable targets
3. Enter target URL
4. Check authorization checkbox
5. Click Start Scan or Execute Command
6. View results in real-time

💻 Command Line Interface

Test Local Vulnerable Application

Create and test against a local vulnerable app:

Test Remote Target

Scan Multiple Targets

🎯 Advanced: Manual Nuclei Commands

Basic vulnerability detection:

Execute custom commands:

Scan multiple targets:

📁 Project Structure

📚 Documentation Highlights

docs/TECHNICAL.md ⭐ Most Comprehensive Resource

• 100% complete explanation of the vulnerability
• Visual diagrams and flowcharts
• Line-by-line payload breakdown
• Starts from basics, no prior knowledge needed
• Perfect for learning, training, and reporting

🔬 Technical Details

The vulnerability stems from unsafe deserialization in React Server Components. Attackers can:

1. Send malicious JSON payloads via HTTP POST
2. Exploit prototype pollution in JavaScript
3. Gain access to Node.js child_process module
4. Execute arbitrary system commands

🎓 Complete Educational Resource

Want to understand EXACTLY how this works?

👉 Full Technical Breakdown - docs/TECHNICAL.md

This comprehensive guide includes:

📖 For Beginners

• Clear explanation of React Client vs Server Components
• Why this vulnerability only affects server-side React
• Simple analogies and visual examples

🔍 For Security Professionals

• Complete attack vector analysis
• Line-by-line payload breakdown
• Detection signatures and IoCs
• Comparison with similar vulnerabilities

💻 For Developers

• How Server Actions work under the hood
• Why prototype pollution is dangerous
• Secure coding practices
• Code review checklist

🎯 What You'll Learn

Written in plain language - no PhD required! Goes from "React basics" to "complete exploitation" in one document.

Perfect for:

• 📊 Security reports and presentations
• 🎓 Training materials and workshops
• 🔒 Threat intelligence analysis
• 👨‍💻 Understanding your application's risk

🛡️ Remediation

If you're running a vulnerable version:

Immediate Actions

1. Update React to the latest patched version (19.2.1+)
2. Update Next.js to the latest version
3. Review server logs for exploitation attempts

Additional Security

• Implement input validation and sanitization
• Deploy WAF rules to block malicious patterns
• Apply network segmentation

Full guide: docs/REMEDIATION.md - Complete remediation steps

📚 References

Official Advisories

• React Security Advisory
• Facebook Security Advisory
• Next.js Security Advisory
• Vercel Changelog
• Assetnote React2Shell Scanner

Educational Resources

🎓 Complete Technical Analysis - Our comprehensive guide

• Explains the vulnerability from first principles
• Visual attack flow diagrams
• Complete payload deconstruction
• Detection and prevention strategies
• Perfect for security training and presentations

Why read our technical guide?

• ✅ Starts with "What are Server Components?"
• ✅ Builds up to advanced exploitation techniques
• ✅ Every line of the payload explained
• ✅ Includes real-world examples and PoCs
• ✅ Written in clear, accessible language
• ✅ No prior React knowledge required

Used by: Security researchers, developers, penetration testers, and educators worldwide.

🤝 Contributing

Contributions are welcome! To contribute:

1. Fork the repository
2. Create a feature branch (git checkout -b feature/improvement)
3. Commit your changes (git commit -am 'Add new feature')
4. Push to the branch (git push origin feature/improvement)
5. Open a Pull Request

📝 License

This project is licensed under the MIT License - see the LICENSE file for details.

👥 Author

StealthMoud

• Twitter/X: @StealthMoud
• GitHub: @StealthMoud

⭐ Acknowledgments

• ProjectDiscovery - For the Nuclei scanner framework
• Security Researchers - Who discovered and responsibly disclosed this vulnerability
• React & Next.js Teams - For their rapid response and patch development

🔔 Star This Repository

If you find this tool useful, please ⭐ star this repository to show your support!

Watch this repository for updates and new features.

⚖️ Responsible Disclosure

This tool is released to help security professionals identify and remediate vulnerable systems. Always:

✅ Obtain explicit written permission before testing
✅ Report findings responsibly to affected parties
✅ Comply with all applicable laws and regulations
❌ Never use this tool for unauthorized access
❌ Never use this tool for malicious purposes

Remember: Unauthorized computer access is a crime. Test responsibly.