Exploit for Deserialization of Untrusted Data in Facebook React

githubexploit · 2026-08-07

Description

This advanced React Server Components RCE scanner detects deserialization with DNS exfiltration and shell.

Affected Facebook React versions

Facebook React= 19.0.0, 19.1.0, 19.1.1, 19.2.0

All known vulnerabilities by product

React Server Components React-Server-Dom-Parcel React-Server-Dom-Turbopack React-Server-Dom-Webpack

CVSS 10.0 for CVE-2025-55182

10.0

HIGH SEVERITY

Version 3.1

VectorCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H

Attack Vector:NETWORK

Attack Complexity:LOW

Privileges Required:NONE

User Interaction:NONE

Scope:CHANGED

Confidentiality:HIGH

Integrity:HIGH

Availability:HIGH

Working code

69%confidence this exploit runs

Based on 3 file(s) in the source

Exploit Details

Modified:2026-08-07 18:05

Last Seen:2026-08-07 18:05

Reporter:CerberusMrXi

Written in:Shell

Last commit:2026-08-07

Tags

deserializationremote code executionreact server componentsdomain exfiltrationsecurity scanner

Other exploits for CVE-2025-55182

Exploit for Deserialization of Untrusted Data in Facebook React

2026-08-12 dotnetguardGITHUB

react2shell-poc

2026-08-10 dika-maulidalGITHUB

Exploit for Deserialization of Untrusted Data in Facebook React

2026-07-27 Phucc29GITHUB

Exploit for Deserialization of Untrusted Data in Facebook React

2026-07-24 indra-031GITHUB

Exploit for Deserialization of Untrusted Data in Facebook React

2026-07-23 razureinkGITHUB

react2shell-poc

2026-07-19 LasersinhoGITHUB

Exploit for Deserialization of Untrusted Data in Facebook React

2026-07-16 se1zerGITHUB

Exploit for Deserialization of Untrusted Data in Facebook React

2026-07-16 PedroPLCodeGITHUB

Exploit Code

README3 lines

## https://sploitus.com/exploit?id=7B1282C4-1482-5069-B0C4-5D653E792FD6
# CVE-2025-55182---Advanced-React-Server-Components-RCE-Exploit
Advanced React Server Components RCE scanner for CVE-2025-55182. Features: multi-stage fingerprinting, vulnerability verification, DNS exfiltration, interactive shell, payload obfuscation, and professional reporting (JSON/HTML/PDF). Authorized testing only.