loading
Loading content
loading
Vulnerabilities
Confirm the RSC and Next.js RCE CVEs on a URL or host list.
overview
react2shell-scanner checks hosts for the React Server Components and Next.js RCE flaws CVE-2025-55182 and CVE-2025-66478. It confirms the condition instead of guessing from a version banner.
Run it after httpx has narrowed an estate to live Next.js hosts. Use -l for bulk lists, -t and --timeout for concurrency, and -q for vulnerable-only output.
Prefer this focused check when you only need these two CVEs. For broad template-driven coverage across many issues, use nuclei instead.
use cases
Scan a host list for CVE-2025-55182 and CVE-2025-66478 to find which Next.js deployments are exposed to remote code execution.
Enable quiet mode so a scan over thousands of hosts returns only the vulnerable ones, ready to feed triage without filtering noise.
Switch on verbose mode to see the response details behind each vulnerable host, confirming the detection before raising it.
Use insecure mode (-k) when live targets present self-signed or mismatched TLS certs that would otherwise abort the check.
reference
| Name | Type | Flag | Description |
|---|---|---|---|
| url | STRING | -u | Single URL to check. |
| list | FILE | -l | File of hosts to scan, one per line. |
| threads | STRING | -t | Concurrent threads (default 10). |
| timeout | STRING | --timeout | Request timeout in seconds (default 10). |
| quiet | BOOLEAN | -q | Output only vulnerable hosts. |
| verbose | BOOLEAN | -v | Show response details for vulnerable hosts. |
| insecure | BOOLEAN | -k | Disable SSL certificate verification. |
| all-results | BOOLEAN | --all-results | Save every host outcome, not only vulnerable hosts. |
Showing key inputs. react2shell-scanner exposes 9 inputs in total.
| Name | Type | Flag | Description |
|---|---|---|---|
| url | STRING | -u | Single URL to check |
| list | FILE | -l | File containing hosts (one per line) |
| quiet | BOOLEAN | -q | Only output vulnerable hosts |
| threads | STRING | -t | Number of concurrent threads (default 10) |
| timeout | STRING | --timeout | Request timeout in seconds (default 10) |
| verbose | BOOLEAN | -v | Show response details for vulnerable hosts |
| insecure | BOOLEAN | -k | Disable SSL certificate verification |
| no-color | BOOLEAN | --no-color | Disable colored output |
| all-results | BOOLEAN | --all-results | Save all results, not just vulnerable hosts |
example
# quiet scan of live hosts for CVE-2025-55182 / CVE-2025-66478react2shell-scanner -l live-hosts.txt -q -t 20 --timeout 10 -k[*] react2shell-scanner CVE-2025-55182 / CVE-2025-66478[*] Loaded 4 hosts from live-hosts.txt[*] Checking https://app.example.com[*] Checking https://www.example.com[!] VULNERABLE: https://app.example.com (RSC RCE)[*] Checking https://api.example.com[*] Checking https://staging.example.com[*] Done: 1/4 vulnerableguidance
Use react2shell-scanner to confirm the RSC/Next.js RCE on hosts you have already discovered and probed. It is a targeted CVE check, not a discovery tool, so feed it live hosts from httpx. For broad template-driven scanning across many CVEs, use nuclei.
Template-driven scanner covering many issues. react2shell-scanner is a focused check for these two CVEs.
A single-vulnerability scanner for Log4Shell. Same focused-check pattern aimed at a different flaw.
Probes and classifies hosts. Run it first so the RCE check targets only live Next.js deployments.
faq
related
Automates OS command injection detection and exploitation.
Subdomain takeover scanner with cloud-zone intake.
Locate public CVE proof-of-concept repositories on GitHub.
Decode, forge, crack, and tamper JWTs for auth checks.
Triage reflected special characters on parameterized URLs.
Detect and exploit SQL injection on authorized web targets.
A host list is probed by httpx, then react2shell-scanner checks the live hosts for the Next.js RCE and writes the vulnerable hosts as output.
Facts on this page come from the live Trickest tool library.