News for hackers. Stuff that matters.

A comment on RCE Vulnerability in React and Next.js. Parent comment

Re:RCE Vulnerability in React and Next.js by cowsandmilk on Thursday December 04, 2025 @03:04AM (#46144980)
https://github.com/ejpir/CVE-2025-55182-poc
[ Parent | on HN ]
Re:RCE Vulnerability in React and Next.js by Tomuus on Thursday December 04, 2025 @03:53AM (#46145294)
This POC is not realistic and doesn't work against production builds of Next.js. It requires explicit exposure of gadgets by the user (eg. vm.runInContext) so is invalid as noted on https://react2shell.com
[ Parent | on HN ]
Re:RCE Vulnerability in React and Next.js by cluckindan on Thursday December 04, 2025 @03:53AM (#46145293)
I will believe it works when it is demonstrated against a create-next-app project.
[ Parent | on HN ]
Re:RCE Vulnerability in React and Next.js by slop-cop on Thursday December 04, 2025 @05:17AM (#46145914)
The guy who discovered the actual vulnerability says otherwise.

Delete this distraction to genuine blue teamers and stop shitting up the information landscape with this utter hogwash.

This is why infosec is dead.

https://react2shell.com/

https://github.com/ejpir/CVE-2025-55182-poc/issues/1#issueco...

[ Parent | on HN ]