Deserialization of untrusted data in Meta React Server Dom Webpack
CVSS score
10.0
EPSS probability
%99.8
Risk score
20.0
Published
10 mo ago
Public Exploits · GitHub and Metasploit Intelligence
This tab scans the sources that NVD labels as exploits, GitHub repositories matching the CVE identifier and Rapid7 Metasploit Framework modules. Only links to sources that were actually found are shown.
🔍 Scan for CVE-2025-55182 risks in React Server Components with this non-intrusive tool that helps detect critical vulnerabilities in your applications.
🛡️ Explore CVE-2025-55182, a critical RCE vulnerability in React's Flight Protocol, demonstrating exploitation techniques and mitigation strategies.
🛡️ Scan and assess vulnerabilities in Next.js/Waku with the CVE-2025-55182-Scanner, combining static and dynamic analysis for robust security.
alyaapm/CVE-2025-55182-shellinteractive
🚨 Exploit CVE-2025-55182 to demonstrate RCE in React Server Functions, highlighting risks from insecure prototype references in Next.js applications.
Reactor es una máquina Linux fácil vulnerable a CVE-2025-55182 (React2Shell), RCE sin autenticación en React Server Components. Accedemos como node, crackeamos un hash MD5 de una base de datos SQLite y pivotamos a engineer por SSH. La escalada abusa del flag --inspect de Node.js para ejecutar código como root vía depuración V8.
CVE-2025-55182 "Ghost Action" — pre-auth RCE (React Flight deserialization, Next.js 15.5.6) CTF challenge. Problem only; solve/writeup excluded.
React Server 19.2.0 - Remote Code Execution
Nuclei: React Server Components - Remote Code Execution
Similar Vulnerabilities
Deserialization of untrusted data in Facebook React
Vulnerability in Facebook React
Deserialization of untrusted data in Facebook React
Command injection in Vercel AI
Incorrect authorization in Facebook WhatsApp Business For iOS
Uncontrolled resource consumption in Facebook React
Get this vulnerability through the API
Affected products, version ranges, exploitation status and patch information in a single request, with a free key.
curl -H "x-api-key: $DAYBREACH_API_KEY" \ "https://api.daybreach.dev/api/v1/intel/cves/CVE-2025-55182"