CVE-2026-2265

Summary

An unauthenticated remote code execution (RCE) vulnerability exists in applications that use the Replicator node package manager (npm) version 1.0.5 to deserialize untrusted user input and execute the resulting object.

Affected Software

Weaknesses

• CWE-502 Deserialization of Untrusted Data

ADP Enrichment

CISA ADP Vulnrichment

• SSVC:
• Exploitation: poc
  • Automatable: no
  • Technical Impact: partial

References

• https://github.com/inikulin/replicator
• https://github.com/inikulin/replicator/pull/19
• https://morielharush.github.io/2026/03/31/cve-2026-2265-replicator-deserialization-of-untrusted-data/

• ←Previous
• Next→