{"repo":"kOaDT/poc-cve-2025-55182","free":true,"listed":false,"github":"https://github.com/kOaDT/poc-cve-2025-55182","clone":"git clone https://github.com/kOaDT/poc-cve-2025-55182.git","description":"This repository contains a POC of CVE-2025-55182, a critical (CVSS score 10.0) pre-authentication remote code execution vulnerability affecting React Server Components, also known as React2Shell.","language":"TypeScript","stars":15,"topics":["cve-2025-55182","cybersecurity","exploit","hacking","nextjs","poc","react2shell","reactjs","vulnerability","rce"],"license":null,"category":"security-tools","readme_excerpt":"CVE-2025-55182 (React2Shell) - Proof of Concept ⚠️ WARNING: This repository is for educational and security research purposes only. Do not use this exploit against systems you do not own or have explicit permission to test. Overview This repository contains a proof-of-concept demonstration of CVE-2025-55182 , a critical pre-authentication remote code execution vulnerability affecting React Server Components. CVSS Score: 10.0 (Critical) Affected Versions: - React Server Components 19.0.0, 19.1.0, 19.1.1, and 19.2.0 - Packages: react-server-dom-parcel , react-server-dom-turbopack , react-server-dom-webpack Vulnerability Summary CVE-2025-55182 is an unsafe deserialization vulnerability in React Server Components' Flight protocol implementation. The vulnerability allows unauthenticated attackers to execute arbitrary JavaScript code on the server by crafting malicious payloads that exploit prototype chain traversal and unsafe property access patterns. Root Cause The vulnerability stems from how React Server Components deserialize Flight protocol payloads. When processing module references, the code uses bracket notation to access properties ( moduleExports[metadata[2]] ), which traverses the entire JavaScript prototype chain. This allows attackers to reference properties that weren't explicitly exported, including the constructor property, which provides access to the global Function constructor. By chaining prototype pollution techniques with React's internal chunk processing mec","default_branch":null,"files":null,"tree":[],"storefront":"/r/kOaDT","claimed":false,"request_supported":{"post":"https://gitbuyer.com/r/kOaDT/poc-cve-2025-55182/request-supported","requests":0},"note":"indexed from public GitHub; nothing is for sale on this page. Clone it from GitHub. Paid listings live at /search."}