inikulin/replicator · Security
Replicator deserializes untrusted user input
- GHSA ID
- GHSA-2gmp-34j9-fqjm
- CVE ID
- CVE-2026-2265
- Severity
- medium
- Published
- Updated
- CVSS
- 6.5 · CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N
- CVSS v3
- 6.5 · CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N
Description
An unauthenticated Remote Code Execution (RCE) vulnerability exists in applications that use the Replicator node package manager (npm) version 1.0.5 to deserialize untrusted user input and execute the resulting object.
CWEs
- CWE-502 · Deserialization of Untrusted Data