{"id":51666002,"url":"https://github.com/geeknik/cereal-reaction","last_synced_at":"2026-07-14T20:30:55.638Z","repository":{"id":351978602,"uuid":"1113162848","full_name":"geeknik/cereal-reaction","owner":"geeknik","description":"A sophisticated security tool designed to find critical deserialization vulnerabilities in React applications. It specializes in detecting P0/P1/P2 level security bugs that could break the Internet.","archived":false,"fork":false,"pushed_at":"2025-12-09T16:07:59.000Z","size":6,"stargazers_count":1,"open_issues_count":0,"forks_count":0,"subscribers_count":0,"default_branch":"main","last_synced_at":"2026-06-03T04:33:54.734Z","etag":null,"topics":["bug-bounty","deserialization","fuzzing","react","research","security","vulnerability-scanner"],"latest_commit_sha":null,"homepage":"https://deepforkcyber.com/","language":null,"has_issues":true,"has_wiki":null,"has_pages":null,"mirror_url":null,"source_name":null,"license":"mit","status":null,"scm":"git","pull_requests_enabled":true,"icon_url":"https://github.com/geeknik.png","metadata":{"files":{"readme":"README.md","changelog":null,"contributing":null,"funding":null,"license":"LICENSE","code_of_conduct":null,"threat_model":null,"audit":null,"citation":null,"codeowners":null,"security":null,"support":null,"governance":null,"roadmap":null,"authors":null,"dei":null,"publiccode":null,"codemeta":null,"zenodo":null,"notice":null,"maintainers":null,"copyright":null,"agents":null,"dco":null,"cla":null}},"created_at":"2025-12-09T15:52:51.000Z","updated_at":"2026-04-04T10:44:41.000Z","dependencies_parsed_at":"2026-04-17T11:00:28.288Z","dependency_job_id":null,"html_url":"https://github.com/geeknik/cereal-reaction","commit_stats":null,"previous_names":["geeknik/cereal-reaction"],"tags_count":0,"template":false,"template_full_name":null,"purl":"pkg:github/geeknik/cereal-reaction","repository_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/geeknik%2Fcereal-reaction","tags_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/geeknik%2Fcereal-reaction/tags","releases_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/geeknik%2Fcereal-reaction/releases","manifests_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/geeknik%2Fcereal-reaction/manifests","owner_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/owners/geeknik","download_url":"https://codeload.github.com/geeknik/cereal-reaction/tar.gz/refs/heads/main","sbom_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/geeknik%2Fcereal-reaction/sbom","scorecard":null,"host":{"name":"GitHub","url":"https://github.com","kind":"github","repositories_count":286080680,"owners_count":35478634,"icon_url":"https://github.com/github.png","version":null,"created_at":"2022-05-30T11:31:42.601Z","updated_at":"2026-05-26T15:22:16.424Z","status":"online","status_checked_at":"2026-07-14T02:00:06.603Z","response_time":114,"last_error":null,"robots_txt_status":"success","robots_txt_updated_at":"2025-07-24T06:49:26.215Z","robots_txt_url":"https://github.com/robots.txt","online":true,"can_crawl_api":true,"host_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub","repositories_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories","repository_names_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repository_names","owners_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/owners"}},"keywords":["bug-bounty","deserialization","fuzzing","react","research","security","vulnerability-scanner"],"created_at":"2026-07-14T20:30:53.298Z","updated_at":"2026-07-14T20:30:55.632Z","avatar_url":"https://github.com/geeknik.png","language":null,"funding_links":[],"categories":[],"sub_categories":[],"readme":"# Cereal Reaction\n\n\u003cimg width=\"1024\" height=\"572\" alt=\"image\" src=\"https://github.com/user-attachments/assets/a46ebe8f-49a4-40ab-94a8-f11dc39bb6ad\" /\u003e\n\n🥛 **Advanced React Deserialization Vulnerability Scanner**\n\nCereal Reaction is a sophisticated security tool designed to find critical deserialization vulnerabilities in React applications. It specializes in detecting P0/P1/P2 level security bugs that could break the Internet, including:\n\n- **Prototype Pollution** vulnerabilities\n- **Unsafe Deserialization** patterns\n- **Object Injection** attacks\n- **Property Tampering** exploits\n- **Component Injection** flaws\n\n## 🚨 Key Features\n\n- **AST-based Static Analysis**: Deep code analysis using Abstract Syntax Trees\n- **Vulnerability Classification**: Automatic P0/P1/P2 severity rating\n- **Pattern Recognition**: Advanced detection of known vulnerability patterns\n- **Exploit Generation**: Generate proof-of-concept exploits\n- **Comprehensive Reporting**: Detailed security analysis reports\n- **Multi-format Support**: JavaScript, TypeScript, JSX, TSX\n\n## 🎯 Detection Capabilities\n\n### P0 (Critical)\n- Direct prototype pollution through React props\n- Object prototype manipulation in component lifecycle\n- Unsafe JSON parsing with user input\n- Component injection through untrusted data\n\n### P1 (High)\n- Indirect prototype pollution vectors\n- Unsafe object property assignment\n- Weak deserialization controls\n- Prop drilling vulnerabilities\n\n### P2 (Medium)\n- Potential prototype pollution patterns\n- Unsafe data transformation\n- Weak input validation\n- Component data leakage\n\n## 📦 Installation\n\n```bash\nnpm install -g cereal-reaction\n```\n\n## 🚀 Quick Start\n\n```bash\n# Scan a React project\ncereal-reaction scan ./my-react-app\n\n# Scan with specific vulnerability types\ncereal-reaction scan ./my-app --types \"prototype-pollution,object-injection\"\n\n# Generate detailed report\ncereal-reaction scan ./my-app --report-format json --output security-report.json\n```\n\n## 🔧 Configuration\n\nCreate a `.cereal-reaction.yml` configuration file:\n\n```yaml\nscan:\n  include: [\"src/**/*.{js,jsx,ts,tsx}\"]\n  exclude: [\"node_modules/**\", \"build/**\"]\n\nvulnerabilities:\n  types: [\"prototype-pollution\", \"unsafe-deserialization\", \"component-injection\"]\n  severity: [\"P0\", \"P1\", \"P2\"]\n\nreporting:\n  format: \"detailed\"\n  include-exploits: true\n  confidence-threshold: 0.7\n```\n\n## 🛡️ Security Focus\n\nBased on the latest security research from 2024-2025, Cereal Reaction specifically targets:\n\n- **CVE-2024-XXXXX**: React prop drilling prototype pollution\n- **Component Library vulnerabilities**: npm ecosystem issues\n- **React Native**: Mobile-specific deserialization flaws\n- **Framework-level issues**: Core React security concerns\n\n## 📊 Reporting\n\nThe tool provides comprehensive security reports including:\n- Vulnerability classification\n- Attack vectors\n- Exploit examples\n- Remediation recommendations\n- Risk assessment scores\n\n## ⚠️ Disclaimer\n\nThis tool is intended for authorized security testing and research only. Use responsibly and only on applications you have permission to test.\n\n## 🤝 Contributing\n\nWe welcome contributions from the security community. Please see our contributing guidelines for more information.\n\n## 📄 License\n\nMIT License - see LICENSE file for details.\n","project_url":"https://awesome.ecosyste.ms/api/v1/projects/github.com%2Fgeeknik%2Fcereal-reaction","html_url":"https://awesome.ecosyste.ms/projects/github.com%2Fgeeknik%2Fcereal-reaction","lists_url":"https://awesome.ecosyste.ms/api/v1/projects/github.com%2Fgeeknik%2Fcereal-reaction/lists"}