PT-2026-29565 · Unknown · Replicator

Moriel Harush · CVE-2026-2265 · Published 2026-04-01 · Updated 2026-04-01

Positive Technologies (AI Summary)

CVSS v3.1

6.5

Medium

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N

Name of the Vulnerable Software and Affected Versions Replicator versions 1.0.5

Description A remote code execution (RCE) issue exists in applications utilizing the Replicator node package manager. The vulnerability stems from the deserialization of untrusted user input, leading to the execution of the resulting object. This allows for unauthenticated access and potential compromise of systems.

Recommendations Update Replicator to a version that addresses this issue.

Exploit

Fix

Deserialization of Untrusted Data

Weakness Enumeration

CWE-502

Related Identifiers

CVE-2026-2265

GHSA-2GMP-34J9-FQJM

Affected Products

Replicator

References · 7

• 🔥 https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/2xxx/CVE-2026-2265.json · Exploit
• https://osv.dev/vulnerability/GHSA-2gmp-34j9-fqjm · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2026-2265 · Security Note
• https://osv.dev/vulnerability/CVE-2026-2265 · Vendor Advisory
• https://github.com/inikulin/replicator/pull/19 · Note
• https://github.com/inikulin/replicator · Note
• https://morielharush.github.io/2026/03/31/cve-2026-2265-replicator-deserialization-of-untrusted-data · Note