CVE-2026-2265: Replicator deserializes untrusted user input

April 1, 2026 (updated April 3, 2026)

An unauthenticated Remote Code Execution (RCE) vulnerability exists in applications that use the Replicator node package manager (npm) version 1.0.5 to deserialize untrusted user input and execute the resulting object.

References

github.com/advisories/GHSA-2gmp-34j9-fqjm
github.com/inikulin/replicator
github.com/inikulin/replicator/pull/19
morielharush.github.io/2026/03/31/cve-2026-2265-replicator-deserialization-of-untrusted-data
nvd.nist.gov/vuln/detail/CVE-2026-2265

Code Behaviors & Features

Detect and mitigate CVE-2026-2265 with GitLab Dependency Scanning

Secure your software supply chain by verifying that all open source dependencies used in your projects contain no disclosed vulnerabilities. Learn more about Dependency Scanning →