Verified — React Server Components Flight protocol remote code execution
Severity CRITICAL
Confidence HIGH
Reproduced in 34m 46s
Tool calls 200
Spend $3.96
Affected 19.0.0, 19.1.0, 19.1.1, 19.2.0
Fixed in 19.0.1, 19.1.2, 19.2.1
$
pruva-verify REPRO-2026-00196 or
curl -O https://pruva.dev/api/v1/reproductions/REPRO-2026-00196/artifacts/bundle/repro/reproduction_steps.sh && chmod +x reproduction_steps.sh && ./reproduction_steps.sh Run in a VM or disposable container. This exploits a real vulnerability.
A pre-authentication remote code execution vulnerability affects React Server Components packages react-server-dom-webpack, react-server-dom-parcel, and react-server-dom-turbopack in versions 19.0.0, 19.1.0–19.1.1, and 19.2.0. The server-side decoding of React Server Function requests unsafely deserializes attacker-controlled payloads, allowing an unauthenticated attacker to craft a malicious HTTP request and achieve arbitrary code execution.
The agent's step-by-step process — every tool call, every handoff, the moment the exploit fired. Phases: support triages the advisory · repro reproduces it · vuln_variant confirms the fix blocks it · judge verifies.
Loading session...
Scripts, logs, diffs, and output captured during the reproduction.
bundle/repro/runtime_manifest.json0.9 KBbundle/repro/validation_verdict.json0.7 KBbundle/ticket.json3.5 KBbundle/ticket.md3.0 KBbundle/logs/server_vuln.log0.4 KBbundle/logs/server_fixed.log0.4 KBbundle/logs/reproduction_steps.log6.1 KBbundle/repro/reproduction_steps.sh22.9 KBbundle/repro/rca_report.md5.0 KBbundle/repro/artifacts/request_vuln.txt0.6 KBbundle/repro/artifacts/response_vuln.txt0.0 KBbundle/repro/artifacts/rce_marker_vuln.txt0.1 KBbundle/repro/artifacts/request_fixed.txt0.7 KBbundle/repro/artifacts/response_fixed.txt0.1 KB