React — PoC Archivehttps://poc.intelseclab.com/tags/react/Latest proof-of-concept entries.Hugoen-usMon, 06 Jul 2026 00:00:00 +0000React Server Components Flight-Protocol Prototype Pollution RCE — "React2Shell" (CVE-2025-55182)https://poc.intelseclab.com/pocs/web/2026-07-06_cve-2025-55182-react-server-components-rce/Mon, 06 Jul 2026 00:00:00 +0000https://poc.intelseclab.com/pocs/web/2026-07-06_cve-2025-55182-react-server-components-rce/Critical severity (CVSS 10) — web · CVE-2025-55182. Status: PoC. Affects: React Server Components (RSC) packages using the Flight protocol (commonly deployed via Next.js). Tags: react, react-server-components, rsc, flight-protocol, prototype-pollution, deserialization, unauthenticated-rce, nextjs, nodejs, python.webCriticalreactreact-server-componentsrscflight-protocolprototype-pollutiondeserializationunauthenticated-rcenextjsnodejspythonTanStack Query — Unbounded Recursion Denial of Service in `replaceEqualDeep` (CVE-2026-26903)https://poc.intelseclab.com/pocs/web/2026-07-05_cve-2026-26903-tanstack-query-dos-recursion/Sun, 05 Jul 2026 00:00:00 +0000https://poc.intelseclab.com/pocs/web/2026-07-05_cve-2026-26903-tanstack-query-dos-recursion/Medium severity — web · CVE-2026-26903. Status: PoC. Affects: TanStack Query (@tanstack/query-core and framework bindings: react-query, vue-query, solid-query, svelte-query). Tags: tanstack-query, javascript, denial-of-service, stack-overflow, recursion, react, frontend, client-side-dos.webMediumtanstack-queryjavascriptdenial-of-servicestack-overflowrecursionreactfrontendclient-side-dosAppsmith Table Widget Stored XSS to Admin Account Takeover — CVE-2026-30862https://poc.intelseclab.com/pocs/web/2026-07-05_cve-2026-30862-appsmith-stored-xss-privesc/Sun, 05 Jul 2026 00:00:00 +0000https://poc.intelseclab.com/pocs/web/2026-07-05_cve-2026-30862-appsmith-stored-xss-privesc/Critical severity (CVSS 9.1) — web · CVE-2026-30862 (GHSA-5hw4-whxv-6794). Status: PoC. Affects: Appsmith. Tags: appsmith, stored-xss, csrf, privilege-escalation, xsrf-token, react, low-code.webCriticalappsmithstored-xsscsrfprivilege-escalationxsrf-tokenreactlow-codeReact2Shell - Next.js RSC Unauthenticated RCEhttps://poc.intelseclab.com/pocs/web/2026-05-17_react2shell-rce/Sun, 17 May 2026 00:00:00 +0000https://poc.intelseclab.com/pocs/web/2026-05-17_react2shell-rce/Critical severity (CVSS 10) — web · CVE-2025-55182. Status: Weaponized. Affects: Next.js (App Router with React Server Components), React. Tags: RCE, Next.js, React, RSC, deserialization, prototype-pollution, unauthenticated, Node.js, cloud.webCriticalRCENext.jsReactRSCdeserializationprototype-pollutionunauthenticatedNode.jscloud