CVEvulnerability

CVE-2026-2265

6.5 MEDIUM Published 2026-04-01 Modified 2026-06-17 Official page ↗

Status: Awaiting Analysis
Published: 2026-04-01
Last modified: 2026-06-17
Assigner: [email protected]
CVSS 3.1 (134c704f-9b21-4f2e-91b3-4a467353bcc0): 6.5 MEDIUM — CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N

Description

An unauthenticated remote code execution (RCE) vulnerability exists in applications that use the Replicator node package manager (npm) version 1.0.5 to deserialize untrusted user input and execute the resulting object.

References

https://github.com/inikulin/replicator github.com
https://github.com/inikulin/replicator/pull/19 github.com
https://morielharush.github.io/2026/03/31/cve-2026-2265-replicator-deserialization-of-untrusted-data/ morielharush.github.io