CVE-2026-2265 in Replicator
Summary
An unauthenticated remote code execution (RCE) vulnerability exists in applications that use the Replicator node package manager (npm) version 1.0.5 to deserialize untrusted user input and execute the resulting object.
Responsible
certcc
Reservation
02/09/2026
Disclosure
04/01/2026
Entries
VulDB provides additional information and datapoints for this CVE:
| ID | Vulnerability | CWE | Exp | Cou | CVE |
|---|---|---|---|---|---|
| 354730 | Replicator deserialization | 502 | Not defined | Not defined | CVE-2026-2265 |