medium6.5
CVE-2026-2265
An unauthenticated remote code execution (RCE) vulnerability exists in applications that use the Replicator node package manager (npm) version 1.0.5 to deseria…
Impact
An unauthenticated remote code execution (RCE) vulnerability exists in applications that use the Replicator node package manager (npm) version 1.0.5 to deserialize untrusted user input and execute the resulting object.
Affected packages
| Ecosystem | Package | Affected | Fixed in |
|---|---|---|---|
| npm | replicator | <= 1.0.5 | none recorded |
Weakness classification
References
- NVD record
- CVE.org record
- GitHub advisory
- https://github.com/advisories/GHSA-2gmp-34j9-fqjm
- https://nvd.nist.gov/vuln/detail/CVE-2026-2265
- https://github.com/inikulin/replicator/pull/19
- https://github.com/inikulin/replicator
- https://morielharush.github.io/2026/03/31/cve-2026-2265-replicator-deserialization-of-untrusted-data
- https://morielharush.github.io/2026/03/31/cve-2026-2265-replicator-deserialization-of-untrusted-data/