react2shell-scanner - Security scanner for CVE-2025-55182 - Critical RCE

项目说明

react2shell-guard

Security scanner for C - a critical (CVSS 10.0) unauthenticated Remote Code Execution in React Ser.

> ⚠️ DISCLAIMER
>
> This is a security scanner, NOT an exploit tool. It is designed to help de and security teams identify dependencies in their projects.
>
> This is a community-driven open source project provided "AS IS" without warranty of any kind, express or implied. The authors and contributors are not responsible for any damages or security incidents arising from the use of this tool.
>
> Use at your own risk and responsibility. Always findings manually and follow your organization's security policies. If you discover any issues, bugs, or ha, please contribute back to help improve the project for e.

> 🤝 CONTRIBUTORS WANTED
>
> This project is actively looking for testers and contributors! Whether you want to report bugs, suggest features, impro, or submit code - all contributions are welcome. Check out our Contributing Guide to get started.

Acknowledgments

This project exists to help the community respond to C. We acknowledge and thank:

Quick Start

1. Instant Scan (No Installation)

The fastest way to check if your project is :

That's it! This will scan your current directory and show results immediately.

2. Scan a Specific Project

3. Auto-Fix

Found ? Fix them automatically:

4. Scan Live URLs

Check if a deployed application is :

5. Patch Was Applied

Confirm your deployed fix is working:

6. Scan Container Images

Check if your Docker images contain packages:

7. Create Fix PR (GitHub)

Automatically create a GitHub PR to fix :

---

What is C?

On No 29th, 2025, security researcher Lachlan Da discovered and responsibly disclosed a critical in React Ser. The flaw exists in how React decodes payloads sent to React Ser endpoints, allowing unauthenticated attackers to achie code execution on affected servers without any user interaction.

C is rated CVSS 10.0 (Critical) and affects React Ser (RSC) and frameworks using the RSC "Flight" protocol.

Affected Packages:

More Information:

---

Installation (Optional)

For frequent use, install globally:

Then use without npx:

---

Usage Guide

Basic Scanning

Output Formats

CLI Options

| Option | Description |
|--------|-------------|
| --json | Output results as JSON |
| --sarif | Output results as SARIF 2.1.0 |
| --html <file> | Generate standalone HTML report |
| --no-exit-on-vuln | Don't exit with code 1 when found |
| --ignore-path <patterns> | Paths to ignore (e.g., examples/**) |
| --debug | Enable debug output |

Exit Codes

| Code | Meaning |
|------|---------|
| 0 | No found |
| 1 | detected |
| 2+ | Fatal error |

Live URL Scanning

Scan li to detect if they are :

How Live URL Scanning Works

The scanner uses passi to detect React Ser endpoints without exploiting the :

1. Probe Request: Sends a crafted POST request simulating an RSC Ser call with a minimal payload:
- Uses multipart/form-data content type with RSC-like data structure
- Includes Next-Action header to trigger Ser processing

2. Response Analysis: Analyzes the HTTP response for signatures:
- Checks for HTTP 500 status code (error response)
- Matches response body against RSC Flight protocol error patterns:
- ^[0-9]+:E{ - RSC Flight protocol error format
- "digest":"...RSC - RSC digest in error responses
- ReactSer - React error class names
- text/x-component.*error - Component error content type

3. Non-Destructive: This is purely a detection mechanism - it does not execute any malicious payload or exploit the . The probe uses benign data that triggers error responses on servers but causes no harm.

> Note: A positi means the server is running a and returned an RSC-specific error signature. It does NOT mean the server was exploited.

URL Scanner Options

| Option | Description |
|--------|-------------|
| --list | Treat target as a file containing URLs |
| --threads <n> | Number of concurrent threads (default: 10) |
| --timeout <ms> | Request timeout in milliseconds (default: 10000) |
| --json | Output results as JSON |
| --skip-ssl- | Skip SSL certificate |
| -- | Show all results including non- hosts |

Patch

if a target has been patched against the :

How Patch Works

Patch performs multiple consecuti (default: 3) with brief delays between them to ensure accurate detection:

1. Multiple Probes: Runs the same passi check 3 times with 500ms delays
2. Confidence Scoring:
- High confidence: 2+ successful scans with consistent results
- Medium confidence: 1 successful scan with conclusi
- Low confidence: All scans failed or inconclusi
3. Result Classification:
- PATCHED: No signatures detected across all successful scans
- : signature detected in one or more scans
- Inconclusive: Mixed results or all scans failed

This multi-scan approach reduces false positives from transient network issues and provides higher confidence in the patch status.

Options

| Option | Description |
|--------|-------------|
| --timeout <ms> | Request timeout in milliseconds (default: 10000) |
| --json | Output results as JSON |
| --skip-ssl- | Skip SSL certificate |

Container Image Scanning

Scan Docker/OCI container images for packages:

Container Scanner Options

| Option | Description |
|--------|-------------|
| --timeout <ms> | Operation timeout in milliseconds (default: 120000) |
| --skip-pull | Skip pulling image from registry (use local only) |
| --json | Output results as JSON |
| --sarif | Output results as SARIF 2.1.0 |
| --no-exit-on-vuln | Don't exit with code 1 when found |
| --debug | Enable debug output |

Requirements:

Deployment Integration

Block deployments before they reach production:

Check Options

| Option | Description |
|--------|-------------|
| --no-fail | Warn but do not fail the build on |
| --ignore-path <patterns> | Paths to ignore (glob patterns) |
| --debug | Enable debug output |

GitHub PR Automation

Automatically create a pull request to fix :

Create PR Options

| Option | Description |
|--------|-------------|
| --branch <name> | Branch name for the fix (default: fix/c) |
| --dry-run | Show what would be done without making changes |
| --no-push | Create branch and commits but do not push or create PR |

Requirements:

Example Output

GitHub Actions Integration

> Note: We actively release new with impro patterns and fixes. Use @v1 for stable releases or for the newest .

GitHub Marketplace Action

The easiest way to integrate is using our official GitHub Action:

Full-Featured Setup (SARIF + PR Comments)

Action Inputs

| Input | Description | Default |
|-------|-------------|---------|
| path | Path to scan | . |
| scan-type | Type of scan: repo, sbom, container | repo |
| format | Output format: text, json, sarif | text |
| fail-on-vuln | Fail if found | true |
| upload-sarif | Upload SARIF to GitHub Security | false |
| add-pr-comment | Add PR comment with results | false |
| ignore-paths | Comma-separated paths to ignore | '' |
| sbom-file | SBOM file path (when scan-type is sbom) | '' |
| container-image | Docker image (when scan-type is container) | '' |

Action Outputs

| Output | Description |
|--------|-------------|
| | Whether were found (true/false) |
| findings-count | Number of packages |
| scan-result | Full scan result (JSON format) |
| sarif-file | Path to SARIF output file |

Scan Container Images

Scan SBOM Files

Manual CLI Usage

If you prefer to use the CLI directly:

Supported Package Managers

react2shell-guard automatically detects and parses lockfiles from:

Features

Auto-Fix

Automatically update your package.json to use patched :

Pre-Commit Hooks

Install git hooks to prevent committing dependencies:

Supported hook frameworks:

The hook will block commits when package.json contains dependencies and suggest running react2shell-guard fix to remediate.

SBOM Scanning

Scan CycloneDX SBOM files for :

MCP Server (AI Assistant Integration)

Start the Model Context Protocol server for AI assistant integration:

A MCP tools:

Configure with MCP-compatible clients (example configuration):

Runtime Protection Middleware

Defense-in-depth middleware that detects and blocks C exploit attempts at runtime.

Express.js

Next.js

Detected patterns:

API Usage

JSON Output Schema

Remediation

Automatic fix (recommended):

Manual upgrade - React packages:

Manual upgrade - Next.js:

Fixed Next.js by release line:

De

License

MIT

项目信息

开发语言：TypeScript

Star 数：58

技术要点

该项目属于安全软件方向的开源资源，代码结构清晰，适合安全研究人员学习参考。项目围绕Security scanner for CVE-2025-55182 - Critical RCE vulnerability in React Server Components. Scan npm/pnpm/yarn lockfiles, Docker images, SBOMs, and live URLs. Auto-fix, SARIF output, GitHub Actions, Vercel integration, and runtime protection middleware.展开，提供了可运行的实现，对理解相关安全机制、工具原理与攻防技术具有较高的研究价值。

从技术实现角度看，此类项目的核心在于对底层原理的深入理解与工程化落地。开发者在研究过程中可以结合官方文档与社区讨论，梳理项目的初始化流程、核心模块职责与数据流转，逐步掌握其中的技术细节与设计思路。

使用与学习建议

1. 下载源码压缩包，解压到本地环境。

2. 根据项目类型准备对应的运行环境与依赖。

3. 按照 README 中的步骤完成配置与部署。

4. 在隔离的测试环境中运行验证，避免影响生产系统。

免责声明

本资源来源于开源社区，仅供安全研究、技术学习与合法授权范围内的攻防演练使用，请勿用于任何非法或侵害他人权益的用途。使用本项目产生的一切后果由使用者自行承担。