Real CVEs: React2Shell (CVE-2025-55182), December 2025
Real CVEInjectionIntermediate+68 -0
Click a line to select it, or press and drag down the changes to select a block (Shift-click works too).Tap a line to select it. To select a block, tap its first line, then its last. Then name the weakness and submit the finding. Each finding is marked as soon as you submit it. On the keyboard, Tab to a file's changes, move with the arrow keys, hold Shift to select a block, and press Enter to flag it.
| @@ -595,0 +595,44 @@ | |||
| 595 | + | function getOutlinedModel<T>( | |
|---|---|---|---|
| 596 | + | response: Response, | |
| 597 | + | reference: string, | |
| 598 | + | parentObject: Object, | |
| 599 | + | key: string, | |
| 600 | + | map: (response: Response, model: any) => T, | |
| 601 | + | ): T { | |
| 602 | + | const path = reference.split(':'); | |
| 603 | + | const id = parseInt(path[0], 16); | |
| 604 | + | const chunk = getChunk(response, id); | |
| 605 | + | switch (chunk.status) { | |
| 606 | + | case RESOLVED_MODEL: | |
| 607 | + | initializeModelChunk(chunk); | |
| 608 | + | break; | |
| 609 | + | } | |
| 610 | + | // The status might have changed after initialization. | |
| 611 | + | switch (chunk.status) { | |
| 612 | + | case INITIALIZED: | |
| 613 | + | let value = chunk.value; | |
| 614 | + | for (let i = 1; i < path.length; i++) { | |
| 615 | + | value = value[path[i]]; | |
| 616 | + | } | |
| 617 | + | return map(response, value); | |
| 618 | + | case PENDING: | |
| 619 | + | case BLOCKED: | |
| 620 | + | case CYCLIC: | |
| 621 | + | const parentChunk = initializingChunk; | |
| 622 | + | chunk.then( | |
| 623 | + | createModelResolver( | |
| 624 | + | parentChunk, | |
| 625 | + | parentObject, | |
| 626 | + | key, | |
| 627 | + | chunk.status === CYCLIC, | |
| 628 | + | response, | |
| 629 | + | map, | |
| 630 | + | path, | |
| 631 | + | ), | |
| 632 | + | createModelReject(parentChunk), | |
| 633 | + | ); | |
| 634 | + | return (null: any); | |
| 635 | + | default: | |
| 636 | + | throw chunk.reason; | |
| 637 | + | } | |
| 638 | + | } | |
| @@ -234,0 +234,24 @@ | |||
| 234 | + | export function requireModule<T>(metadata: ClientReference<T>): T { | |
|---|---|---|---|
| 235 | + | let moduleExports = __webpack_require__(metadata[ID]); | |
| 236 | + | if (isAsyncImport(metadata)) { | |
| 237 | + | if (typeof moduleExports.then !== 'function') { | |
| 238 | + | // This wasn't a promise after all. | |
| 239 | + | } else if (moduleExports.status === 'fulfilled') { | |
| 240 | + | // This Promise should've been instrumented by preloadModule. | |
| 241 | + | moduleExports = moduleExports.value; | |
| 242 | + | } else { | |
| 243 | + | throw moduleExports.reason; | |
| 244 | + | } | |
| 245 | + | } | |
| 246 | + | if (metadata[NAME] === '*') { | |
| 247 | + | // This is a placeholder value that represents that the caller imported this | |
| 248 | + | // as a CommonJS module as is. | |
| 249 | + | return moduleExports; | |
| 250 | + | } | |
| 251 | + | if (metadata[NAME] === '') { | |
| 252 | + | // This is a placeholder value that represents that the caller accessed the | |
| 253 | + | // default property of this if it was an ESM interop module. | |
| 254 | + | return moduleExports.__esModule ? moduleExports.default : moduleExports; | |
| 255 | + | } | |
| 256 | + | return moduleExports[metadata[NAME]]; | |
| 257 | + | } | |
This challenge is Training Content. We encourage you to discuss it and to publish your own write-ups and videos of it.