## https://sploitus.com/exploit?id=E3DE8FEB-A7DE-5EA6-8D62-50C987451300
# CVE-2025-55182 — Next.js Flight Deserialization RCE
**Remote Code Execution exploit for Next.js Server Actions (Flight) deserialization vulnerability**
[](https://dotnetguard.blog)
[](https://www.python.org)
[](LICENSE)
---
## 📌 Overview
This repository contains a working exploit for **CVE-2025-55182**, a
deserialization vulnerability in the **Next.js Flight protocol** (Server
Actions). By crafting a malicious Flight chunk, an unauthenticated attacker
can pollute the `__proto__` chain (`then` / `constructor` gadget), reach the
`child_process` module and achieve **arbitrary remote code execution** on the
target server.
The exploit retrieves command output by smuggling it inside the `NEXT_REDIRECT`
error digest, giving you a clean, stateless RCE primitive on every request.
## ⚠️ Legal & Authorization
> **This tool is for authorized security assessments, penetration tests and
> CTF challenges only.**
> You are responsible for complying with all applicable laws and for having
> explicit written permission to test any target. The author assumes no
> liability for misuse.
## ✨ Features
- 🎯 **Single-command execution** — `whoami`, `id`, file reads, anything
- 🔄 **Reverse shell chain** — 5 payload variants (python3, python, bash, nc, busybox)
- 💬 **Interactive mode** — semi-shell with a custom prompt
- 🧹 **Smart output parsing** — HTML-decodes and extracts the digest payload
- 🚀 **Zero dependencies** — only `requests` (PEP 723 inline script compatible)
## 📦 Installation
```bash
git clone https://github.com/dotnetguard/CVE-2025-55182-Exploit.git
cd CVE-2025-55182-Exploit
# Option A — classic
pip install requests
python3 exploit.py
# Option B — uv (PEP 723 inline dependencies)
uv run exploit.py