gensecaihq/React2Shell Guard - CVE-2025-55182 Scanner
Scan for CVE-2025-55182 - Critical RCE in React Server Components. Detects vulnerable Next.js/React packages.
View on GitHubTrust Signals
- Scorecard Score
- not yet scored
- Maintenance Recency
- Maintainedlast commit Dec 7, 2025
- License
- MIT
Pinned Snippet
uses: gensecaihq/react2shell-scanner@9ade82fc9968a2b1389b5a165e061047702e651d # v1.1.1tags can be moved; commit SHAs can't. why a SHA?
Inputs
| name | description | required | default |
|---|---|---|---|
| path | Path to scan (default: current directory) | no | . |
| scan-type | Type of scan: repo, sbom, or container | no | repo |
| sbom-file | Path to CycloneDX SBOM file (when scan-type is sbom) | no | "" |
| container-image | Docker image to scan (when scan-type is container) | no | "" |
| format | Output format: text, json, or sarif | no | text |
| fail-on-vuln | Fail the action if vulnerabilities are found | no | true |
| upload-sarif | Upload SARIF results to GitHub Security tab (requires format: sarif) | no | false |
| ignore-paths | Comma-separated list of paths to ignore (glob patterns) | no | "" |
| add-pr-comment | Add a comment to the PR with scan results | no | false |
| github-token | GitHub token for PR comments (defaults to github.token) | no | ${{ github.token }} |
Outputs
| name | description |
|---|---|
| vulnerable | Whether vulnerabilities were found (true/false) |
| findings-count | Number of vulnerable packages found |
| scan-result | Full scan result in JSON format |
| sarif-file | Path to SARIF output file (if format is sarif) |