React CVE-2025-55182 Vulnerability Scanner

A bash script to scan your server for React applications vulnerable to CVE-2025-55182 — a critical remote code execution vulnerability (CVSS 10.0) in React Server Components.

⚠️ About the Vulnerability

On December 3, 2025, the React team disclosed a critical security vulnerability affecting React Server Components. An unauthenticated attacker can exploit a flaw in how React decodes payloads sent to React Server Function endpoints to achieve remote code execution.

Affected packages:

• react-server-dom-webpack versions 19.0.0, 19.1.0, 19.1.1, 19.2.0
• react-server-dom-parcel versions 19.0.0, 19.1.0, 19.1.1, 19.2.0
• react-server-dom-turbopack versions 19.0.0, 19.1.0, 19.1.1, 19.2.0

Fixed versions: 19.0.1, 19.1.2, 19.2.1

📖 Official React Blog Post

🚀 Quick Start

One-liner Install & Run

curl -sSL https://raw.githubusercontent.com/umairahmadh/react-vuln-scanner/main/scan-react-vuln.sh | sudo bash

Manual Installation

# Download
curl -O https://raw.githubusercontent.com/umairahmadh/react-vuln-scanner/main/scan-react-vuln.sh

# Make executable
chmod +x scan-react-vuln.sh

# Run with sudo for full system scan
sudo ./scan-react-vuln.sh

System-wide Installation

sudo curl -o /usr/local/bin/scan-react-vuln https://raw.githubusercontent.com/umairahmadh/react-vuln-scanner/main/scan-react-vuln.sh
sudo chmod +x /usr/local/bin/scan-react-vuln

# Now run from anywhere
sudo scan-react-vuln

📋 What It Scans

The script scans the following locations for React applications:

Exclusions (to reduce false positives)

• node_modules/ directories
• .cache/, .npm/, .pnpm/ directories
• WordPress directories (wp-content/, wp-includes/, plugins/, themes/)

🎨 Output

The scanner provides color-coded output:

• 🔴 [VULNERABLE] - Application has vulnerable RSC packages installed
• 🟢 [SAFE] - Application has React but no vulnerable packages
• 🟡 [UPDATE RECOMMENDED] - React version that may be affected

Example Output

============================================================
  React CVE-2025-55182 Vulnerability Scanner
  Critical: Remote Code Execution (CVSS 10.0)
============================================================

Scanning for React applications...

Scanning: /home/deploy (owner: deploy)
[VULNERABLE] my-nextjs-app
  Path: /home/deploy/my-nextjs-app
  Owner: deploy
    - [email protected] (VULNERABLE)
    - [email protected] (UPDATE RECOMMENDED)

[SAFE] my-react-spa
  Path: /home/deploy/my-react-spa
  Owner: deploy
    - [email protected]

============================================================
  SCAN COMPLETE
============================================================

🔧 Requirements

• Bash 4.0+ (for associative arrays)
• Linux/macOS (uses find, grep, sed)
• Optional: jq for more reliable JSON parsing

Check your bash version:

bash --version

🛠️ Fixing Vulnerabilities

If the scanner finds vulnerable applications, update them immediately:

General React Apps

npm install react@latest react-dom@latest
npm install react-server-dom-webpack@latest

Next.js

npm install [email protected]   # or latest in your release line

React Router (with RSC)

npm install react@latest react-dom@latest react-server-dom-parcel@latest

Waku

npm install react@latest react-dom@latest react-server-dom-webpack@latest waku@latest

🔒 Security Notes

• Run with sudo to scan all user directories
• The script is read-only and does not modify any files
• Exit code 0 = no vulnerabilities found
• Exit code 1 = vulnerabilities detected (useful for CI/CD)

📄 License

MIT License - Free to use, modify, and distribute.

🤝 Contributing

Pull requests welcome! Please ensure any changes:

1. Don't introduce false positives
2. Maintain backward compatibility
3. Work without jq installed

📚 References

• CVE-2025-55182
• React Security Advisory
• Next.js Changelog

Made with ❤️ for the React community. Stay safe! 🛡️