React2shell PoC - CVE-2025-66478

This repository contains a React/Next.js proof-of-concept project for CVE-2025-66478.

Project Layout

• my-cve-2025-66478-app/ - Next.js app used for the React2shell PoC

Tech Stack

• Next.js 16.0.6
• React 19.2.0
• TypeScript
• Tailwind CSS v4

Getting Started

1. Go to the app directory:

cd my-cve-2025-66478-app

2. Install dependencies:

npm install

3. Start the development server:

npm run dev

4. Open:

http://localhost:3000

Available Scripts

Run these commands inside my-cve-2025-66478-app:

• npm run dev - Start local dev server
• npm run build - Build production bundle
• npm run start - Start production server
• npm run lint - Run ESLint

Notes

• The app currently starts from the default Next.js template structure in app/page.tsx.
• Use this project as the base for reproducing and documenting the React2shell behavior tied to CVE-2025-66478.