EUVD-2026-17958
GHSA-2gmp-34j9-fqjm
Severity by source
AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N
Primary rating from NVD · only source for this CVE.
CVSS VectorNVD
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N
Lifecycle Timeline
3Blast Radius
ecosystem impact- 141 npm packages depend on replicator (31 direct, 110 indirect)
Ecosystem-wide dependent count for version 1.0.5.
DescriptionCVE.org
An unauthenticated remote code execution (RCE) vulnerability exists in applications that use the Replicator node package manager (npm) version 1.0.5 to deserialize untrusted user input and execute the resulting object.
AnalysisAI
Remote code execution in Replicator npm package version 1.0.5 allows unauthenticated attackers to execute arbitrary code by supplying malicious serialized objects that the library deserializes without validation. Applications using Replicator to process untrusted input are vulnerable to immediate compromise; no public exploit code availability or active exploitation status is confirmed at time of analysis, but the unauthenticated attack vector and ease of object deserialization attacks suggest practical exploitability.
Technical ContextAI
Replicator is a Node.js package designed to serialize and deserialize JavaScript objects. The vulnerability stems from unsafe deserialization practices where user-supplied serialized data is reconstructed into executable objects without integrity or source validation. This is a classic insecure deserialization weakness (CWE category: improper neutralization of input during deserialization) affecting the Node.js ecosystem. The CPE cpe:2.3:a:replicator:replicator:*:*:*:*:*:*:*:* indicates the package itself is the attack surface; any application dependency on Replicator 1.0.5 inherits this risk. The attack requires only network access to an application endpoint that invokes Replicator's deserialization functions with attacker-controlled input.
RemediationAI
Upgrade Replicator to a patched version beyond 1.0.5 if available from the maintainer; refer to the GitHub repository (https://github.com/inikulin/replicator) and the pull request (https://github.com/inikulin/replicator/pull/19) for the current fix status and patched release version. If a patched version is not yet released, apply temporary mitigation by avoiding deserialization of untrusted user input through Replicator, or implementing input validation and signing on serialized objects before deserialization. Update npm dependencies via npm audit and npm update to pull the latest patched version once released. Consult the security advisory linked in the references for exact remediation guidance.
FortiOS and FortiProxy contain an authentication bypass via the Node.js websocket module allowing unauthenticated remote
Eval injection vulnerability in the internals.batch function in lib/batch.js in the bassmaster plugin before 1.5.2 for t
Flowise version 3.0.5 contains a remote code execution vulnerability in the CustomMCP node. The mcpServerConfig paramete
Node.js 8.5.0 before 8.6.0 allows remote attackers to access unintended files, because a change to ".." handling was inc
An issue was discovered in the node-serialize package 0.0.4 for Node.js. Rated critical severity (CVSS 9.8), this vulner
Directory traversal vulnerability in the st module before 0.2.5 for Node.js allows remote attackers to read arbitrary fi
Multiple SQL injection vulnerabilities in the Manage Accounts page in the AccountManagement.asmx service in the Solarwin
The JS-YAML module before 2.0.5 for Node.js parses input without properly considering the unsafe !!js/function tag, whic
Directory traversal vulnerability in lib/app/index.js in Geddy before 13.0.8 for Node.js allows remote attackers to read
Credential-harvesting malware compromised 84 versions of 42 TanStack npm packages on 2026-05-11 via chained GitHub Actio
Eval injection vulnerability in index.js in the syntax-error package before 1.1.1 for Node.js 0.10.x, as used in IBM Rat
The HTTP server in Node.js 0.10.x before 0.10.21 and 0.8.x before 0.8.26 allows remote attackers to cause a denial of se
Share
External POC / Exploit Code
Leaving vuln.today