Unauthenticated Remote Code Execution Vulnerability in Replicator Package by Inikulin
CVE-2026-2265

6.5MEDIUM

Key Information:

Vendor

Replicator

Status
Replicator
Vendor
CVE Published:
1 April 2026

What is CVE-2026-2265?

An unauthenticated remote code execution vulnerability exists in the Replicator package manager, specifically in version 1.0.5. This flaw allows attackers to exploit the deserialization of untrusted user input, leading to the execution of arbitrary commands. As a result, applications that utilize this version may be susceptible to unauthorized access and manipulation, posing significant risks to the security of the affected systems. Vigilance and timely updates are essential to mitigate this risk.

Affected Version(s)

Replicator 1.0.5

References

https://github.com/inikulin/replicator
https://github.com/inikulin/replicator/pull/19
https://morielharush.github.io/2026/03/31/cve-2026-2265-r...

CVSS V3.1

Score:
6.5
Severity:
MEDIUM
Confidentiality:
Low
Integrity:
Low
Availability:
Low
Attack Vector:
Network
Attack Complexity:
Low
Privileges Required:
None
User Interaction:
None
Scope:
Unchanged

Timeline

  • Vulnerability published

  • Vulnerability Reserved

.