{"id":"CVE-2026-2265","aliases":["EUVD-2026-17958","GHSA-2gmp-34j9-fqjm"],"status":"published","title":"Replicator 1.0.5 is vulnerable to Remote Code Execution through Insecure Deserialization","description":"An unauthenticated remote code execution (RCE) vulnerability exists in applications that use the Replicator node package manager (npm) version 1.0.5 to deserialize untrusted user input and execute the resulting object.","severity":{"version":"3.1","score":6.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N","level":"medium","assessor":"adp","from":"cve"},"epss":{"day":"2026-11-11","score":0.00402,"percentile":0.34937,"model":"v2026.06.15"},"facts":{"in_kev":false,"known_exploited":false,"public_exploit":false,"fix_available":false},"cwes":["CWE-502"],"published":"2026-04-01T16:11:25Z","modified":"2026-10-28T02:30:45Z","affected":[{"source":"ghsa","ecosystem":"npm","package":"replicator","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"last_affected":"1.0.5"}]}]},{"source":"osv","ecosystem":"npm","package":"replicator","ranges":[{"type":"SEMVER","events":[{"introduced":"0"},{"last_affected":"1.0.5"}]}]}],"products":[{"vendor":"replicator","product":"replicator"}],"references":[{"url":"https://github.com/inikulin/replicator","tags":["package"]},{"url":"https://github.com/inikulin/replicator/pull/19","tags":["fix","web"]},{"url":"https://morielharush.github.io/2026/03/31/cve-2026-2265-replicator-deserialization-of-untrusted-data/","tags":["web"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-2265","tags":["advisory"]},{"url":"https://morielharush.github.io/2026/03/31/cve-2026-2265-replicator-deserialization-of-untrusted-data","tags":["web"]},{"url":"https://github.com/advisories/GHSA-2gmp-34j9-fqjm"},{"url":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/2xxx/CVE-2026-2265.json","tags":["advisory"]}],"sources":{"cve":[{"id":"CVE-2026-2265","title":"Replicator 1.0.5 is vulnerable to Remote Code Execution through Insecure Deserialization","description":"An unauthenticated remote code execution (RCE) vulnerability exists in applications that use the Replicator node package manager (npm) version 1.0.5 to deserialize untrusted user input and execute the resulting object.","status":"published","published":"2026-04-01T16:11:25.107Z","modified":"2026-04-01T19:27:36.981Z","cvss":[{"version":"3.1","score":6.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N","level":"medium","assessor":"adp"}],"updated_at":"2026-11-02T13:48:35.749498Z"}],"euvd":[{"id":"EUVD-2026-17958","description":"An unauthenticated remote code execution (RCE) vulnerability exists in applications that use the Replicator node package manager (npm) version 1.0.5 to deserialize untrusted user input and execute the resulting object.","status":"published","published":"2026-04-01T16:11:25Z","modified":"2026-04-01T19:27:36Z","cvss":[{"version":"3.1","score":6.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N","level":"medium"}],"updated_at":"2026-11-02T19:25:23.620594Z"}],"ghsa":[{"id":"GHSA-2gmp-34j9-fqjm","title":"Replicator deserializes untrusted user input","description":"An unauthenticated Remote Code Execution (RCE) vulnerability exists in applications that use the Replicator node package manager (npm) version 1.0.5 to deserialize untrusted user input and execute the resulting object.","status":"published","published":"2026-04-01T18:36:38Z","modified":"2026-04-03T23:15:23Z","cvss":[{"version":"3.1","score":6.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N","level":"medium"}],"cwes":["CWE-502"],"updated_at":"2026-11-02T14:39:47.945242Z"}],"nvd":[{"id":"CVE-2026-2265","description":"An unauthenticated remote code execution (RCE) vulnerability exists in applications that use the Replicator node package manager (npm) version 1.0.5 to deserialize untrusted user input and execute the resulting object.","status":"published","published":"2026-04-01T17:28:38.41Z","modified":"2026-06-17T10:30:40.46Z","cvss":[{"version":"3.1","score":6.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N","level":"medium","assessor":"secondary"}],"updated_at":"2026-11-02T14:12:12.73929Z"}],"osv":[{"id":"CVE-2026-2265","title":"Replicator 1.0.5 is vulnerable to Remote Code Execution through Insecure Deserialization","description":"An unauthenticated remote code execution (RCE) vulnerability exists in applications that use the Replicator node package manager (npm) version 1.0.5 to deserialize untrusted user input and execute the resulting object.","status":"published","published":"2026-04-01T16:11:25.107Z","modified":"2026-10-28T02:30:45.514306385Z","cvss":[{"version":"3.1","score":6.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N","level":"medium"}],"updated_at":"2026-11-02T15:44:58.42038Z"},{"id":"GHSA-2gmp-34j9-fqjm","title":"Replicator deserializes untrusted user input","description":"An unauthenticated Remote Code Execution (RCE) vulnerability exists in applications that use the Replicator node package manager (npm) version 1.0.5 to deserialize untrusted user input and execute the resulting object.","status":"published","published":"2026-04-01T18:36:38Z","modified":"2026-04-03T23:41:22.392265Z","cvss":[{"version":"3.1","score":6.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N","level":"medium"}],"cwes":["CWE-502"],"updated_at":"2026-11-02T15:46:34.338541Z"}]}}