EGuzman Baltazar749809 (Community Member) asked a question.
Veracode SCA not detecting CVE-2025-55182
Hi Veracode community,
Hope you are doing great.
Anyone have a PoC usefull to detect CVE-2025-55182
I tried using a PoC that states the vulnerable dependencies like:
"react": "19.0.0",
"react-dom": "19.0.0",
"next": "15.0.0"
But Veracode SCA didn't flag anything.
So I need to know if Veracode is actually able to detect this finding or is still working on it...
.png){kind=logo}
Hi @EGuzman Baltazar749809 (Community Member) - Hope you're doing well, as well!
Here's a link to this CVE in our vulnerability database, it has more information about how the list of libraries are affected: https://sca.analysiscenter.veracode.com/vulnerability-database/security/remote-code-execution-rce-/javascript/sid-152939/summary
It looks like you may have found this vulnerability in two apps.
Regarding your POC -your app must use the specific react components shown in the screenshot below.
Hey Sam,
Thanks for your response.
I have indeed checked the veracode vuln db, and uploaded a vulnerable version to veracode SAST / SCA scan with a Very High SAST SCA scan policy config.
For the SCA I'm using:
{
"name": "test_veracode",
"dependencies": {
"next": "14.1.0",
"react": "18.2.0",
"react-dom": "18.2.0"
}
}
Github security flags those components having many vulnerabilities, sadly Veracode does not seem to find any in the scan.
Hi @EGuzman Baltazar749809 (Community Member) -
The vulnerability was introduced via next 14.3.0 . Also, you will want to make sure Veracode is detecting your components in the scan.