I hereby claim:
- I am matrosov on github.
- I am matrosov (https://keybase.io/matrosov) on keybase.
- I have a public key whose fingerprint is B58F 5182 FF96 B3A6 0F05 99F8 2A2D 380D 4CAD 31E1
To claim this, I am signing this object:
Alex Matrosov matrosov
matrosov
/ scan-react2shell-deps.sh
Created
December 8, 2025 03:02
Tiny ripgrep-based inventory scanner for React2Shell-affected React Server Components.
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| #!/usr/bin/env bash | |
| set -euo pipefail | |
| # Vulnerable RSC versions (React2Shell) | |
| VULN='19\.0\.0|19\.1\.0|19\.1\.1|19\.2\.0' | |
| PKG='react-server-dom-(webpack|parcel|turbopack)' | |
| echo "=== React2Shell(CVE-2025-55182) RSC dependency inventory ===" | |
| echo |
matrosov
/ react2shell-semgrep.yaml
Last active
December 8, 2025 23:21
Static analysis rules for detecting React2Shell(CVE-2025-55182) exposure in JS/TS codebases.
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| rules: | |
| # ======================================================================== | |
| # Detection of CVE-2025-55182 (React2Shell) exposure and exploitability | |
| # | |
| # TIER 1: Inventory-level (vulnerable deps or at-risk Next.js) | |
| # TIER 2: Exposure-level (server imports of RSC libraries) | |
| # TIER 3: Exploit chain (taint from HTTP → decodeReply/decodeAction/etc.) | |
| # ======================================================================== | |
| # ------------------------------------------------------------------------ |
matrosov
/ keybase.md
Created
December 5, 2015 01:30
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| struct s0 { | |
| signed char[124] pad124; | |
| uint32_t f124; | |
| }; | |
| struct s1 { | |
| signed char[124] pad124; | |
| int32_t f124; | |
| }; |
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| void __fastcall CMarkup::UpdateMarkupContentsVersion(CMarkup *this, int a2) | |
| { | |
| int v2; // eax@1 | |
| int v3; // ecx@3 | |
| int v4; // eax@3 | |
| int v5; // eax@6 | |
| int v6; // eax@8 | |
| int v7; // eax@9 | |
| int v8; // ecx@13 | |
| int v9; // esi@14 |