CVE-2026-2265

—

CVSS 3.1

6.5 medium

EPSS

<1%p30

Published

Apr 1, 2026 (Apr 1, 2026)

Modified

Jun 17, 2026

Description

An unauthenticated remote code execution (RCE) vulnerability exists in applications that use the Replicator node package manager (npm) version 1.0.5 to deserialize untrusted user input and execute the resulting object.

Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N

NVD CVE.org GitHub PoCs EPSS (0.4%)

In the news0 stories

No ingested article mentions this CVE yet.