assetnote/react2shell-scanner

Health v2 · maintenance only

Flags: no_releases no_license

Adoption not part of the score

2459 stars · 271 forks observed · 2026-08-28

What it is AI-extracted, prompt v1, taxonomy v1, 2026-08-30, confidence not recorded

A Python command-line scanner that detects RCE vulnerabilities CVE-2025-55182 and CVE-2025-66478 in Next.js applications using React Server Components. It sends crafted multipart POST payloads with a deterministic math proof-of-concept and offers safe side-channel detection, WAF bypass, and Windows target modes.

Use cases

• scan next.js sites for cve-2025-55182 rce
• check if my react server components app is vulnerable
• bulk scan a list of hosts for react2shell
• detect next.js rce without executing code on target
• bypass waf when scanning for rce vulnerability
• scan windows-hosted next.js for rce

When to choose

• you need high-fidelity detection of CVE-2025-55182/CVE-2025-66478 in Next.js/RSC apps
• you want a safe side-channel check mode that avoids executing code
• you need bulk scanning with threading, custom headers, and JSON output

When to avoid

• your stack does not use Next.js or React Server Components
• you need a general-purpose web vulnerability scanner rather than a targeted CVE check
• you are not authorized to test the target hosts

Facets

cli-tool · maturity active

vulnerability-scanning security cli security penetration-testing web-development developer-tools cli python cross-platform cve-scanner nextjs react-server-components rce-detection waf-bypass pentesting

Member repositories

For agents

markdown · JSON · MCP: product_card(name="assetnote/react2shell-scanner")