CVE-2026-2265

An unauthenticated remote code execution (RCE) vulnerability exists in applications that use the Replicator node package manager (npm) version 1.0.5 to deserialize untrusted user input and execute the resulting object.

Score

CVSS 3.1 6.5 Medium

Status

Awaiting Analysis - cret@cert.org

Published

2026-04-01

Last modified

2026-04-01

Affected products

• Replicator (Replicator)

References

• https://github.com/inikulin/replicator
• https://github.com/inikulin/replicator/pull/19
• https://morielharush.github.io/2026/03/31/cve-2026-2265-replicator-deserialization-of-untrusted-data/