# React2Shell

> Look for React Server Components exposure signals linked to CVE-2025-55182 on a site you own, and read what each result means.

Source: https://docs.vigilbase.com/tools/react2shell

The React2Shell Scanner sends detection requests to a React or Next.js site and looks for React Server Components (RSC) response signals linked to CVE-2025-55182, the critical unauthenticated remote code execution issue disclosed on December 3, 2025. Run it at [vigilbase.com/tools/react2shell](https://vigilbase.com/tools/react2shell).

> [!WARNING]
> The scanner sends POST requests with a harmless detection payload to the URL you give it. Only scan sites you own or are allowed to test.

## Why you verify your email first

The scan is intrusive, so you verify a work email before it runs, and the email domain must match the site's domain. Personal and free mailbox providers are refused. Verification confirms you can read the mailbox; it does not give you permission to test the site.

## Run a scan

:::steps
1. **Enter the URL and your work email.**
2. **Complete the security check** and request the code.
3. **Enter the 6-digit code** from the email. The scan runs and shows its progress.
4. **Read the result.** It is also emailed to you with a link to the saved run.
:::

## How the scan works

The scanner sends two detection requests to the URL, each shaped like a React Server Action call:

1. A `multipart/form-data` request.
2. An `application/x-www-form-urlencoded` variant.

It reads the status, content type and the first part of each response body for RSC Flight protocol signals and server error digests. It does not run code on the target.

## What each result means

The scanner gives a status, not a letter grade.

| Result | Meaning | What to do |
| --- | --- | --- |
| **Manual Review Required** | The responses showed RSC signals that need a person to look at them. An ordinary Flight response or a server error digest does not confirm remote code execution or source code exposure. | Check the installed React and Next.js versions against the official advisories. |
| **No Vulnerability Indicators Detected** | No RSC indicators were found. The site may not use React Server Components, or may not be a React app. | This does not prove every RSC issue is patched; keep your versions current. |
| **Scan Could Not Complete** | The scan could not finish, for example because the site timed out or refused the requests. | Check the URL and try again. |

## Fix it

Upgrade React and Next.js to a patched release. For Next.js, the advisory for CVE-2025-66478 lists these first fixed versions:

| Release line | Fixed in |
| --- | --- |
| 15.0.x | 15.0.5 |
| 15.1.x | 15.1.9 |
| 15.2.x | 15.2.6 |
| 15.3.x | 15.3.6 |
| 15.4.x | 15.4.8 |
| 15.5.x | 15.5.7 |
| 16.0.x | 16.0.7 |
| 15.x canary | 15.6.0-canary.58 |
| 16.x canary | 16.1.0-canary.12 |

Later React advisories added denial-of-service and source code exposure fixes in the same packages; React states that 19.0.4, 19.1.5 and 19.2.4 are safe. Next.js also advises rotating secrets for apps that were online and unpatched as of December 4, 2025 at 1:00 PM PT.

Sources: the React blog post "Critical Security Vulnerability in React Server Components", the Next.js advisory for CVE-2025-66478 and NVD entry CVE-2025-55182.

## Also in Website Security

[Website Security](https://docs.vigilbase.com/tools/website-security) includes the React2Shell signals among its 27 checks. From the CLI, the scanner runs through Vigilbase One and needs a sign-in:

```bash
vigilbase login
vigilbase run react2shell https://example.com
```