GitHub Advisoryadvisory · npm

GHSA-2gmp-34j9-fqjm Replicator deserializes untrusted user input

MEDIUM Published 2026-04-01 Modified 2026-04-03 Official page ↗
Aliases
CVE-2026-2265
Ecosystem
npm
Packages
replicator
Severity
Moderate
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N
Weaknesses
CWE-502
Reviewed
2026-04-03

Affected packages

• npm replicator: <= 1.0.5 (no fix yet)

Description

An unauthenticated Remote Code Execution (RCE) vulnerability exists in applications that use the Replicator node package manager (npm) version 1.0.5 to deserialize untrusted user input and execute the resulting object.

Related

Alias · CVE (1)

  • CVE-2026-2265 An unauthenticated remote code execution (RCE) vulnerability exists in applications that use the Replicator node package manager (npm)… vulnerability

Weakness · CWE (1)

  • CWE-502 Deserialization of Untrusted Data weakness

References