CVE-2025-55182 // REACT SERVER COMPONENTS RCE

[ OVERVIEW ] Exploit PoC for CVE-2025-55182. Targets unsafe versions and input validation functions vulnerabilities in React Server Components.

[ TECHNICAL MECHANISM ]

• Vector : Prototype pollution via $1:proto:then during hydration.
• Payload : RCE via process.mainModule.require('child_process').
• Exfil : Data leakage through X-Action-Redirect headers.

[ REQUIREMENTS ]

• python3
• requests

[ STRATEGIES ]

• standard : Direct child_process execution.
• obfuscated : Hex encoding bypass feature for basic WAF pattern matching.

[ DISCLAIMER ] For authorized security research and educational purposes only.

[ USAGE ]

Basic check

python3 exploit.py -t -c "id"

WAF bypass attempt

python3 exploit.py -t -c "cat /etc/passwd (RCE Command)" -s obfuscated