Description (CNA)
An unauthenticated remote code execution (RCE) vulnerability exists in applications that use the Replicator node package manager (npm) version 1.0.5 to deserialize untrusted user input and execute the resulting object.
Affected (CNA)
| Vendor / product | Versions |
|---|---|
| Replicator / Replicator | affected 1.0.5 |
CWE
No CWE identifiers supplied.
References
- https://github.com/inikulin/replicator
- https://github.com/inikulin/replicator/pull/19
- https://morielharush.github.io/2026/03/31/cve-2026-2265-replicator-deserialization-of-untrusted-data/
ADP enrichment
No English description supplied.
No references supplied.