ReactOOPS HTB lab
target:NexusAI’s polished assistant interface promises adaptive learning and seamless interaction. But beneath its reactive front end, subtle glitches hint that user input may be shaping the system in unexpected ways. Explore the platform, trace the echoes in its reactive layer, and uncover the hidden flaw buried behind the UI.
that centers around exploiting CVE-2025–55182, a vulnerability in Next.js React Server Components.
I used the RSC Security Tool extension, which helps detect specific vulnerabilities in React-based web applications.
Get AlvaGad’s stories in your inbox
Join Medium for free to get updates from this writer.
With command execution verified, the next step is to explore the filesystem and locate the flag.
now i will discover the we-bsite by direction app
there are a file (flag.txt) we will try read that file
I found the flag
