Search

Find a vulnerability

Search criteria

    2 vulnerabilities by Replicator

    CVE-2026-2265 (GCVE-0-2026-2265)

    Vulnerability from nvd – Published: 2026-04-01 16:11 – Updated: 2026-04-01 19:27
    VLAI
    Title
    Replicator 1.0.5 is vulnerable to Remote Code Execution through Insecure Deserialization
    Summary
    An unauthenticated remote code execution (RCE) vulnerability exists in applications that use the Replicator node package manager (npm) version 1.0.5 to deserialize untrusted user input and execute the resulting object.
    Severity
    6.5 (Medium)
    CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N
    SSVC
    Exploitation: poc Automatable: no Technical Impact: partial
    CISA Coordinator (v2.0.3)
    CWE
    Assigner
    References
    Impacted products
    Vendor Product Version
    Replicator Replicator Affected: 1.0.5
    		Create a notification for this product.
    Show details on NVD website
    To clipboard 

    {
  "containers": {
    "adp": [
      {
        "metrics": [
          {
            "cvssV3_1": {
              "attackComplexity": "LOW",
              "attackVector": "NETWORK",
              "availabilityImpact": "NONE",
              "baseScore": 6.5,
              "baseSeverity": "MEDIUM",
              "confidentialityImpact": "LOW",
              "integrityImpact": "LOW",
              "privilegesRequired": "NONE",
              "scope": "UNCHANGED",
              "userInteraction": "NONE",
              "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N",
              "version": "3.1"
            }
          },
          {
            "other": {
              "content": {
                "id": "CVE-2026-2265",
                "options": [
                  {
                    "Exploitation": "poc"
                  },
                  {
                    "Automatable": "no"
                  },
                  {
                    "Technical Impact": "partial"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2026-04-01T19:27:21.463751Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2026-04-01T19:27:36.981Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "product": "Replicator",
          "vendor": "Replicator",
          "versions": [
            {
              "status": "affected",
              "version": "1.0.5"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "An unauthenticated remote code execution (RCE) vulnerability exists in applications that use the Replicator node package manager (npm) version 1.0.5 to deserialize untrusted user input and execute the resulting object."
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "description": "CWE-502 Deserialization of Untrusted Data",
              "lang": "en"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-04-01T16:11:25.107Z",
        "orgId": "37e5125f-f79b-445b-8fad-9564f167944b",
        "shortName": "certcc"
      },
      "references": [
        {
          "url": "https://github.com/inikulin/replicator"
        },
        {
          "url": "https://github.com/inikulin/replicator/pull/19"
        },
        {
          "url": "https://morielharush.github.io/2026/03/31/cve-2026-2265-replicator-deserialization-of-untrusted-data/"
        }
      ],
      "source": {
        "discovery": "UNKNOWN"
      },
      "title": "Replicator 1.0.5 is vulnerable to Remote Code Execution through Insecure Deserialization",
      "x_generator": {
        "engine": "VINCE 3.0.35",
        "env": "prod",
        "origin": "https://cveawg.mitre.org/api/cve/CVE-2026-2265"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "37e5125f-f79b-445b-8fad-9564f167944b",
    "assignerShortName": "certcc",
    "cveId": "CVE-2026-2265",
    "datePublished": "2026-04-01T16:11:25.107Z",
    "dateReserved": "2026-02-09T19:27:28.332Z",
    "dateUpdated": "2026-04-01T19:27:36.981Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

    CVE-2026-2265 (GCVE-0-2026-2265)

    Vulnerability from cvelistv5 – Published: 2026-04-01 16:11 – Updated: 2026-04-01 19:27
    VLAI
    Title
    Replicator 1.0.5 is vulnerable to Remote Code Execution through Insecure Deserialization
    Summary
    An unauthenticated remote code execution (RCE) vulnerability exists in applications that use the Replicator node package manager (npm) version 1.0.5 to deserialize untrusted user input and execute the resulting object.
    Severity
    6.5 (Medium)
    CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N
    SSVC
    Exploitation: poc Automatable: no Technical Impact: partial
    CISA Coordinator (v2.0.3)
    CWE
    Assigner
    References
    Impacted products
    Vendor Product Version
    Replicator Replicator Affected: 1.0.5
    		Create a notification for this product.
    Show details on NVD website
    To clipboard 

    {
  "containers": {
    "adp": [
      {
        "metrics": [
          {
            "cvssV3_1": {
              "attackComplexity": "LOW",
              "attackVector": "NETWORK",
              "availabilityImpact": "NONE",
              "baseScore": 6.5,
              "baseSeverity": "MEDIUM",
              "confidentialityImpact": "LOW",
              "integrityImpact": "LOW",
              "privilegesRequired": "NONE",
              "scope": "UNCHANGED",
              "userInteraction": "NONE",
              "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N",
              "version": "3.1"
            }
          },
          {
            "other": {
              "content": {
                "id": "CVE-2026-2265",
                "options": [
                  {
                    "Exploitation": "poc"
                  },
                  {
                    "Automatable": "no"
                  },
                  {
                    "Technical Impact": "partial"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2026-04-01T19:27:21.463751Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2026-04-01T19:27:36.981Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "product": "Replicator",
          "vendor": "Replicator",
          "versions": [
            {
              "status": "affected",
              "version": "1.0.5"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "An unauthenticated remote code execution (RCE) vulnerability exists in applications that use the Replicator node package manager (npm) version 1.0.5 to deserialize untrusted user input and execute the resulting object."
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "description": "CWE-502 Deserialization of Untrusted Data",
              "lang": "en"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-04-01T16:11:25.107Z",
        "orgId": "37e5125f-f79b-445b-8fad-9564f167944b",
        "shortName": "certcc"
      },
      "references": [
        {
          "url": "https://github.com/inikulin/replicator"
        },
        {
          "url": "https://github.com/inikulin/replicator/pull/19"
        },
        {
          "url": "https://morielharush.github.io/2026/03/31/cve-2026-2265-replicator-deserialization-of-untrusted-data/"
        }
      ],
      "source": {
        "discovery": "UNKNOWN"
      },
      "title": "Replicator 1.0.5 is vulnerable to Remote Code Execution through Insecure Deserialization",
      "x_generator": {
        "engine": "VINCE 3.0.35",
        "env": "prod",
        "origin": "https://cveawg.mitre.org/api/cve/CVE-2026-2265"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "37e5125f-f79b-445b-8fad-9564f167944b",
    "assignerShortName": "certcc",
    "cveId": "CVE-2026-2265",
    "datePublished": "2026-04-01T16:11:25.107Z",
    "dateReserved": "2026-02-09T19:27:28.332Z",
    "dateUpdated": "2026-04-01T19:27:36.981Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}