Critical Pre-Authentication Remote Code Execution in React Server Components
A complete proof-of-concept demonstrating CVE-2025-55182, a critical vulnerability in react-server-dom-webpack@19.0.0 that allows unauthenticated attackers to execute arbitrary code via prototype chain pollution.
# Clone the repository
git clone https://github.com/whiteov3rflow/CVE-2025-55182-poc
cd CVE-2025-55182-poc
# Exploit the server
python3 exploit.py 'mkdir poc_test'
This POC is provided for educational and security research purposes only. Only test against systems you own or have explicit permission to test. Unauthorized access to computer systems is illegal.
- CVE-2025-55182
- React Security Advisory
- Credits: maple3142, react2shell.com, assetnote, disnana, harumaki4649, tp-li
Made with 💀 for security research