Vulnerabilities
Confirm CVE-2025-55182 and CVE-2025-66478 on live hosts
react2shell-scanner is a command-line detector from Assetnote for CVE-2025-55182 and CVE-2025-66478, the React Server Components remote code execution flaws in Next.js applications, using a high-fidelity detection methodology to keep false positives down on sites that do not use RSC.
installgit clone https://github.com/assetnote/react2shell-scanner.gitpip install -r requirements.txt
Python
overview
What react2shell-scanner does
react2shell-scanner checks hosts for the React Server Components and Next.js RCE flaws CVE-2025-55182 and CVE-2025-66478. It confirms the condition instead of guessing from a version banner.
Run it after httpx has narrowed an estate to live Next.js hosts. Use -l for bulk lists, -t and --timeout for concurrency, and -q for vulnerable-only output.
Prefer this focused check when you only need these two CVEs. For broad template-driven coverage across many issues, use nuclei instead.
use cases
Where react2shell-scanner fits
Check an estate for the Next.js RCE
Scan a host list for CVE-2025-55182 and CVE-2025-66478 to find which Next.js deployments are exposed to remote code execution.
Keep output to vulnerable hosts only
Enable quiet mode so a scan over thousands of hosts returns only the vulnerable ones, ready to feed triage without filtering noise.
Verify a finding before escalating
Switch on verbose mode to see the response details behind each vulnerable host, confirming the detection before raising it.
Scan hosts with broken certificates
Use insecure mode (-k) when live targets present self-signed or mismatched TLS certs that would otherwise abort the check.
reference
react2shell-scanner inputs and flags
| Name | Type | Flag | Description |
|---|---|---|---|
| url | STRING | -u | Single URL to check. |
| list | FILE | -l | File of hosts to scan, one per line. |
| threads | STRING | -t | Concurrent threads (default 10). |
| timeout | STRING | --timeout | Request timeout in seconds (default 10). |
| quiet | BOOLEAN | -q | Output only vulnerable hosts. |
| verbose | BOOLEAN | -v | Show response details for vulnerable hosts. |
| insecure | BOOLEAN | -k | Disable SSL certificate verification. |
| all-results | BOOLEAN | --all-results | Save every host outcome, not only vulnerable hosts. |
Showing key inputs. react2shell-scanner exposes 9 inputs in total.
Full flag reference (9 inputs)
| Name | Type | Flag | Description |
|---|---|---|---|
| url | STRING | -u | Single URL to check |
| list | FILE | -l | File containing hosts (one per line) |
| quiet | BOOLEAN | -q | Only output vulnerable hosts |
| threads | STRING | -t | Number of concurrent threads (default 10) |
| timeout | STRING | --timeout | Request timeout in seconds (default 10) |
| verbose | BOOLEAN | -v | Show response details for vulnerable hosts |
| insecure | BOOLEAN | -k | Disable SSL certificate verification |
| no-color | BOOLEAN | --no-color | Disable colored output |
| all-results | BOOLEAN | --all-results | Save all results, not just vulnerable hosts |
example
Run react2shell-scanner
# quiet scan of live hosts for CVE-2025-55182 / CVE-2025-66478
react2shell-scanner -l live-hosts.txt -q -t 20 --timeout 10 -k[*] react2shell-scanner CVE-2025-55182 / CVE-2025-66478
[*] Loaded 4 hosts from live-hosts.txt
[*] Checking https://app.example.com
[*] Checking https://www.example.com
[!] VULNERABLE: https://app.example.com (RSC RCE)
[*] Checking https://api.example.com
[*] Checking https://staging.example.com
[*] Done: 1/4 vulnerableguidance
Choosing react2shell-scanner
Use react2shell-scanner to confirm the RSC/Next.js RCE on hosts you have already discovered and probed. It is a targeted CVE check, not a discovery tool, so feed it live hosts from httpx. For broad template-driven scanning across many CVEs, use nuclei.
nuclei
Template-driven scanner covering many issues. react2shell-scanner is a focused check for these two CVEs.
log4j-scan
A single-vulnerability scanner for Log4Shell. Same focused-check pattern aimed at a different flaw.
httpx
Probes and classifies hosts. Run it first so the RCE check targets only live Next.js deployments.
faq
react2shell-scanner questions
related
More Vulnerabilities tools
agentsleak
Black Hat Arsenal runtime security for AI coding agents, evaluated offline over recorded action events.
commix
Automates OS command injection detection and exploitation.
dalfox
Parameter mining and XSS testing with headless verification.
dnsreaper
Subdomain takeover scanner with cloud-zone intake.
find-gh-poc
Locate public CVE proof-of-concept repositories on GitHub.
golemhalt
Black Hat Arsenal reference monitor for coding agents, inventoried as a policy and provider corpus.
Run react2shell-scanner yourself
A host list is probed by httpx, then react2shell-scanner checks the live hosts for the Next.js RCE and writes the vulnerable hosts as output.
Facts on this page come from the live Trickest tool library.