A pre-authentication remote code execution vulnerability exists in React Server Components versions 19

#!/usr/bin/env python3
# verify_cve_2025_55182.py
# Detect vulnerable React Server Components package versions for CVE-2025-55182.
# Exit codes: 0=PATCHED, 1=VULNERABLE, 2=UNKNOWN / error

import json
import os
import sys
from typing import Dict, List, Optional, Tuple

TARGETS = {
    'react-server-dom-webpack': {
        'vuln': [('19.0.0', '19.0.0'), ('19.1.0', '19.1.1'), ('19.2.0', '19.2.0')],
        'fixed': ['19.0.1', '19.1.2', '19.2.1']
    },
    'react-server-dom-parcel': {
        'vuln': [('19.0.0', '19.0.0'), ('19.1.0', '19.1.1'), ('19.2.0', '19.2.0')],
        'fixed': ['19.0.1', '19.1.2', '19.2.1']
    },
    'react-server-dom-turbopack': {
        'vuln': [('19.0.0', '19.0.0'), ('19.1.0', '19.1.1'), ('19.2.0', '19.2.0')],
        'fixed': ['19.0.1', '19.1.2', '19.2.1']
    }
}


def norm(v: str) -> Optional[Tuple[int, int, int]]:
    if not v or not isinstance(v, str):
        return None
    v = v.strip()
    if v.startswith('v'):
        v = v[1:]
    v = v.split('-')[0].split('+')[0]
    parts = v.split('.')
    if len(parts) < 3:
        return None
    try:
        return tuple(int(x) for x in parts[:3])
    except ValueError:
        return None


def cmp_ver(a: str, b: str) -> Optional[int]:
    na, nb = norm(a), norm(b)
    if na is None or nb is None:
        return None
    return (na > nb) - (na < nb)


def in_range(v: str, start: str, end: str) -> bool:
    c1 = cmp_ver(v, start)
    c2 = cmp_ver(v, end)
    return c1 is not None and c2 is not None and c1 >= 0 and c2 <= 0


def is_vulnerable(pkg: str, version: str) -> bool:
    if pkg not in TARGETS:
        return False
    for start, end in TARGETS[pkg]['vuln']:
        if in_range(version, start, end):
            return True
    return False


def flatten_lock_deps(obj, found: Dict[str, List[str]]):
    if isinstance(obj, dict):
        if 'name' in obj and 'version' in obj:
            name = obj.get('name')
            ver = obj.get('version')
            if name in TARGETS and isinstance(ver, str):
                found.setdefault(name, []).append(ver)
        if 'packages' in obj and isinstance(obj['packages'], dict):
            for path, meta in obj['packages'].items():
                if not isinstance(meta, dict):
                    continue
                name = meta.get('name')
                ver = meta.get('version')
                if not name and isinstance(path, str) and 'node_modules/' in path:
                    name = path.split('node_modules/')[-1]
                if name in TARGETS and isinstance(ver, str):
                    found.setdefault(name, []).append(ver)
        if 'dependencies' in obj and isinstance(obj['dependencies'], dict):
            for name, meta in obj['dependencies'].items():
                if name in TARGETS and isinstance(meta, dict) and isinstance(meta.get('version'), str):
                    found.setdefault(name, []).append(meta['version'])
                flatten_lock_deps(meta, found)
        for v in obj.values():
            flatten_lock_deps(v, found)
    elif isinstance(obj, list):
        for item in obj:
            flatten_lock_deps(item, found)


def inspect_lockfile(path: str, found: Dict[str, List[str]]):
    try:
        with open(path, 'r', encoding='utf-8') as f:
            data = json.load(f)
        flatten_lock_deps(data, found)
    except Exception:
        pass


def inspect_node_modules(root: str, found: Dict[str, List[str]]):
    nm = os.path.join(root, 'node_modules')
    if not os.path.isdir(nm):
        return
    for pkg in TARGETS:
        pkg_json = os.path.join(nm, pkg, 'package.json')
        if os.path.isfile(pkg_json):
            try:
                with open(pkg_json, 'r', encoding='utf-8') as f:
                    data = json.load(f)
                ver = data.get('version')
                if isinstance(ver, str):
                    found.setdefault(pkg, []).append(ver)
            except Exception:
                pass


def uniq_versions(found: Dict[str, List[str]]) -> Dict[str, List[str]]:
    out = {}
    for k, vals in found.items():
        dedup = sorted(set(vals), key=lambda x: norm(x) or (999, 999, 999))
        out[k] = dedup
    return out


def main():
    root = sys.argv[1] if len(sys.argv) > 1 else os.getcwd()
    if not os.path.isdir(root):
        print('UNKNOWN - path does not exist or is not a directory: {}'.format(root))
        sys.exit(2)

    found: Dict[str, List[str]] = {}
    for lf in ['package-lock.json', 'npm-shrinkwrap.json']:
        p = os.path.join(root, lf)
        if os.path.isfile(p):
            inspect_lockfile(p, found)
    inspect_node_modules(root, found)

    found = uniq_versions(found)

    if not found:
        print('UNKNOWN - no target packages found in package lockfiles or node_modules under {}'.format(root))
        sys.exit(2)

    vulnerable = []
    patched = []
    unknown = []

    for pkg, versions in found.items():
        for ver in versions:
            n = norm(ver)
            if n is None:
                unknown.append((pkg, ver))
            elif is_vulnerable(pkg, ver):
                vulnerable.append((pkg, ver))
            else:
                patched.append((pkg, ver))

    if vulnerable:
        details = ', '.join(['{}@{}'.format(p, v) for p, v in vulnerable])
        print('VULNERABLE - {}'.format(details))
        sys.exit(1)

    if patched and not vulnerable:
        details = ', '.join(['{}@{}'.format(p, v) for p, v in patched])
        print('PATCHED - {}'.format(details))
        sys.exit(0)

    details = ', '.join(['{}@{}'.format(p, v) for p, v in unknown]) if unknown else 'unable to classify versions'
    print('UNKNOWN - {}'.format(details))
    sys.exit(2)


if __name__ == '__main__':
    main()