A POC for CVE-2025-55182

It is like a fun node.js (or whatever server JS runtime) jail challenge that you would see in a CTF.

CTF in prod. The best kind. The worst kind.

The original poc by Lachlan Davidson is available btw

write-up someday of your technique?

Just added a short writeup for the trick to the gist

thank you!

ayyyyyyyy nice job <3

clean and easy to understand, amazing!

Heya, I see you're passing the child_process exploit string inside the _prefix property. How is this string being passed as an argument to the function? My understanding of the Flight protocol is that the parser doesn't automatically eval() strings in JSON values 🤔

good work I am working on that since the last night and I don't have found a good way to pollute to bypass proxy bundlerConfig. So big gg

Insane poc ! gg

This is insane.

what a gadget :O congrats! seems like first poc

Good work

It appears to work on a fresh created next project, but fails when a middleware (proxy.ts/middleware.ts) redirects unauthenticated users.

@sushicomabacate

hi why not trying Penligent's one-click PoC? @penligent

Incredible work on the gadget chain, thanks for sharing

Good stuff 👏

😅

Can you share the payload? Also a simple explanation of the _prefix thing 😀

PoC is live. If you haven't patched yet, stop scrolling and run this: npx @neurolint/cli security:cve-2025-55182 . --fix Free. Open source. Takes 30 seconds.

Noted

做得好👍

Thanks, i tried it today on my website, to my surprise it worked out, when i checked the /tmp/ it was full o xmrigs already... they are scanning the whole ip range

@h4x0r_dz How much vulnerable servers with this exploit out there?

优雅

@grok о чем видео?

any1 using this for sans?

🐐

To Explain & PoC