RajChowdhury240/React2Shell-CVE-2025-55182

GitHubRepository PoCExploit

PoC files

2 files

File viewing is interactive and short-lived. Downloads are password-protected ZIP archives using password eip.

GitHub
Analysisdeepseek-v4-pro:cloud ·

Technical assessment

A Python script that sends a crafted multipart/form-data POST request to a React Server Components endpoint to achieve remote code execution via unsafe deserialization.

Backdoor review

No backdoor observed in reviewed code

The repository contains a single Python script (xpl.py) that sends a crafted HTTP POST request to exploit CVE-2025-55182. The script constructs a payload targeting React Server Components deserialization and executes a user-supplied command on the target server. No backdoor, deceptive payload, or concealed operator-directed harm against the person running the PoC was observed.

ClassificationExploit
Model confidence100%
AuthenticationNot required
LanguagesPython
Target softwarereact-server-dom-webpackreact-server-dom-turbopackreact-server-dom-parcel
Attack typesRemote Code ExecutionDeserialization of Untrusted Data
Evidence & reasoningClassification basis · observed behavior · safety review
Technical evidence

Classification basis and observed behavior

Classification basis

The script defines and invokes an exploit function that sends a malicious payload designed to execute arbitrary commands on the target server, which is the definition of exploit code.

xpl.py:5-12

Requirements

  • Target must be running a vulnerable version of React Server Components (19.0.0, 19.1.0, 19.1.1, 19.2.0) with an exposed Server Function endpoint.xpl.py:2

Observed behavior

  • Constructs a JSON payload containing a malicious prototype pollution and code injection string targeting child_process.execSync.xpl.py:6
  • Wraps the payload in a multipart/form-data request with a specific boundary and sends it via HTTP POST to the target URL.xpl.py:7-8
  • Prints the HTTP response status code and the first 200 characters of the response body.xpl.py:9
Safety-review evidence

Behaviors behind the backdoor verdict

Observables

Exploit Script
xpl.py sends a multipart POST request with a crafted JSON payload to trigger CVE-2025-55182 RCE.The script is a straightforward proof-of-concept exploit for the stated CVE. It takes a target URL and a command, constructs the exploit payload, and prints the response. This is normal exploit behavior against the stated target.xpl.py:5-9
Command Execution
The payload includes 'process.mainModule.require('child_process').execSync('{cmd}');' to execute an arbitrary command on the target.This is the core of the CVE-2025-55182 exploit, executing commands on the vulnerable server, not on the machine running the PoC.xpl.py:6
Review boundaries

What the analysis did not establish

  • Only the two text files in the repository were reviewed; no binary or non-text files were present.
  • The review does not assess the safety or correctness of the exploit against the target server.
Model interpretation

This review is limited to the supplied PoC code and context. It does not assert that the code works or is safe to execute.

Linked vulnerabilities

1