{"repo":"l4rm4nd/CVE-2025-55182","free":true,"listed":false,"github":"https://github.com/l4rm4nd/CVE-2025-55182","clone":"git clone https://github.com/l4rm4nd/CVE-2025-55182.git","description":"Docker poc lab for CVE-2025-55182 / CVE-2025-66478 (React2Shell) detection and exploitation","language":"JavaScript","stars":86,"topics":["cve-2025-55182","lab","nextjs","react","cve","docker","docker-image","react2shell","vulnerability","poc"],"license":null,"category":"security-tools","readme_excerpt":"React2Shell PoC This repository provides a minimal intentionally vulnerable environment to test security scanners against the recent critical RCE vulnerability (React2Shell) affecting React Server Components and Next.js. CVE-2025-55182 : A pre-authentication remote code execution vulnerability exists in React Server Components versions 19.0.0, 19.1.0, 19.1.1, and 19.2.0 including the following packages: react-server-dom-parcel, react-server-dom-turbopack, and react-server-dom-webpack. The vulnerable code unsafely deserializes payloads from HTTP requests to Server Function endpoints. CVE-2025-66478 : Tracks the downstream impact on Next.js applications using the App Router. [!Warning] This setup is intentionally vulnerable and must never be exposed to the public internet or used in production. --- What is this This app is a very small Next.js project that: - Pins vulnerable versions of: - next : 16.0.6 - react : 19.2.0 - react-dom : 19.2.0 - Uses a minimal NextJS config with app router and React server actions [!TIP] Pinning react and react-dom is optional, as an affected next version is susceptible per default due to app router. How to run How to detect AssetNote Scanner Use the scanner provided by AssetNote: Will return: Nuclei Will return: How to exploit PoC HTTP payload from here. Will return:","default_branch":null,"files":null,"tree":[],"storefront":"/r/l4rm4nd","claimed":false,"request_supported":{"post":"https://gitbuyer.com/r/l4rm4nd/CVE-2025-55182/request-supported","requests":0},"note":"indexed from public GitHub; nothing is for sale on this page. Clone it from GitHub. Paid listings live at /search."}