https://github.com/geeknik/cereal-reaction
A sophisticated security tool designed to find critical deserialization vulnerabilities in React applications. It specializes in detecting P0/P1/P2 level security bugs that could break the Internet.
https://github.com/geeknik/cereal-reaction
bug-bounty deserialization fuzzing react research security vulnerability-scanner
Last synced: 8 days ago
JSON representation
A sophisticated security tool designed to find critical deserialization vulnerabilities in React applications. It specializes in detecting P0/P1/P2 level security bugs that could break the Internet.
- Host: GitHub
- URL: https://github.com/geeknik/cereal-reaction
- Owner: geeknik
- License: mit
- Created: 2025-12-09T15:52:51.000Z (8 months ago)
- Default Branch: main
- Last Pushed: 2025-12-09T16:07:59.000Z (8 months ago)
- Last Synced: 2026-06-03T04:33:54.734Z (about 2 months ago)
- Topics: bug-bounty, deserialization, fuzzing, react, research, security, vulnerability-scanner
- Homepage: https://deepforkcyber.com/
- Size: 5.86 KB
- Stars: 1
- Watchers: 0
- Forks: 0
- Open Issues: 0
-
Metadata Files:
- Readme: README.md
- License: LICENSE
Awesome Lists containing this project
README
# Cereal Reaction
🥛 **Advanced React Deserialization Vulnerability Scanner**
Cereal Reaction is a sophisticated security tool designed to find critical deserialization vulnerabilities in React applications. It specializes in detecting P0/P1/P2 level security bugs that could break the Internet, including:
- **Prototype Pollution** vulnerabilities
- **Unsafe Deserialization** patterns
- **Object Injection** attacks
- **Property Tampering** exploits
- **Component Injection** flaws
## 🚨 Key Features
- **AST-based Static Analysis**: Deep code analysis using Abstract Syntax Trees
- **Vulnerability Classification**: Automatic P0/P1/P2 severity rating
- **Pattern Recognition**: Advanced detection of known vulnerability patterns
- **Exploit Generation**: Generate proof-of-concept exploits
- **Comprehensive Reporting**: Detailed security analysis reports
- **Multi-format Support**: JavaScript, TypeScript, JSX, TSX
## 🎯 Detection Capabilities
### P0 (Critical)
- Direct prototype pollution through React props
- Object prototype manipulation in component lifecycle
- Unsafe JSON parsing with user input
- Component injection through untrusted data
### P1 (High)
- Indirect prototype pollution vectors
- Unsafe object property assignment
- Weak deserialization controls
- Prop drilling vulnerabilities
### P2 (Medium)
- Potential prototype pollution patterns
- Unsafe data transformation
- Weak input validation
- Component data leakage
## 📦 Installation
```bash
npm install -g cereal-reaction
```
## 🚀 Quick Start
```bash
# Scan a React project
cereal-reaction scan ./my-react-app
# Scan with specific vulnerability types
cereal-reaction scan ./my-app --types "prototype-pollution,object-injection"
# Generate detailed report
cereal-reaction scan ./my-app --report-format json --output security-report.json
```
## 🔧 Configuration
Create a `.cereal-reaction.yml` configuration file:
```yaml
scan:
include: ["src/**/*.{js,jsx,ts,tsx}"]
exclude: ["node_modules/**", "build/**"]
vulnerabilities:
types: ["prototype-pollution", "unsafe-deserialization", "component-injection"]
severity: ["P0", "P1", "P2"]
reporting:
format: "detailed"
include-exploits: true
confidence-threshold: 0.7
```
## 🛡️ Security Focus
Based on the latest security research from 2024-2025, Cereal Reaction specifically targets:
- **CVE-2024-XXXXX**: React prop drilling prototype pollution
- **Component Library vulnerabilities**: npm ecosystem issues
- **React Native**: Mobile-specific deserialization flaws
- **Framework-level issues**: Core React security concerns
## 📊 Reporting
The tool provides comprehensive security reports including:
- Vulnerability classification
- Attack vectors
- Exploit examples
- Remediation recommendations
- Risk assessment scores
## ⚠️ Disclaimer
This tool is intended for authorized security testing and research only. Use responsibly and only on applications you have permission to test.
## 🤝 Contributing
We welcome contributions from the security community. Please see our contributing guidelines for more information.
## 📄 License
MIT License - see LICENSE file for details.