Original Proof-of-Concepts for React2Shell CVE-2025-55182

React2Shell Auto Exploit: A CLI tool to exploit prototype pollution vulnerabilities (RCE) in React Server Actions

Security scanner for CVE-2025-55182 - Critical RCE vulnerability in React Server Components. Scan npm/pnpm/yarn lockfiles, Docker images, SBOMs, and live URLs. Auto-fix, SARIF output, GitHub Actions, Vercel integration, and runtime protection middleware.

Docker poc lab for CVE-2025-55182 detection and exploitation

react2shell-scanner is a security research tool designed to detect and demonstrate potentially dangerous patterns in React-based codebases that could lead to command injection, unsafe environment handling, insecure API usage, or other high-impact vulnerabilities.

rsc-detect-cve-2025-55182 is a static analysis tool designed to detect potential indicators of CVE-2025-55182

Step-by-step walkthrough of CVE-2025-55182 (React2Shell) by tracing React's Flight protocol internals.

Nuclei template for detecting react2shell (CVE-2025-55182 & CVE-2025-66478)

chrome extension to detect next.js sites vulnerable to CVE-2025-55182 (react2shell)

React2Shell, CVE-2025-55182, RCE Vulnerability: A critical breakdown of the unsafe deserialization flaw in React Server Components that enables unauthenticated remote code execution across default React/Next.js setups.

CVE-2025-55182 – React2Shell: Proof-of-Concept Remote Code Execution (RCE) exploit for Next.js apps. Features an interactive shell prompt to test and demonstrate the vulnerability in real time. Use for security research and authorized penetration-testing only.

React Server Components versions 19.0.0, 19.1.0, 19.1.1, and 19.2.0, including react-server-dom-parcel, react-server-dom-turbopack, and react-server-dom-webpack, contain a remote code execution vulnerability.

This repository contains a POC of CVE-2025-55182, a critical (CVSS score 10.0) pre-authentication remote code execution vulnerability affecting React Server Components, also known as React2Shell.

Advanced security testing tool for CVE-2025-55182 vulnerability assessment in Next.js applications. Features interactive shell, batch scanning, WAF bypass, and comprehensive reporting.

A test server for demonstrating and testing React2Shell (CVE-2025-55182) vulnerability

A Chrome extension for detecting React2Shell vulnerabilities (CVE-2025-55182 & CVE-2025-66478) in web applications

PoC for React2Shell (CVE-2025-55182)

CVE-2025-55182 + CVE-2025-66478 - Next.js/React Server Components Remote Code Execution

Torito React2Shell Scanner & Exploit Tool (CVE-2025-55182 / 66478)

Detect CVE-2025-55182 (React2Shell) RCE vulnerability in React Server Components. Fast, accurate scanner with zero false positives.