CVE-2026-2265: 
JavaScript vulnerability analysis and mitigation

CVE-2026-2265 is an unauthenticated remote code execution (RCE) vulnerability in the Replicator npm package (version 1.0.5 and earlier) caused by unsafe deserialization of untrusted user input. The vulnerability was discovered by researcher MorielHarush and disclosed on April 1, 2026, with a corresponding GitHub Advisory (GHSA-2gmp-34j9-fqjm) published the same day. All versions of the replicator npm package up to and including 1.0.5 are affected; no patched version has been officially released as of the advisory date. It carries a CVSS v3.1 base score of 6.5 (Medium) (Github Advisory).

The root cause is CWE-502 (Deserialization of Untrusted Data): the replicator package's decode() function processes serialized JavaScript objects — including complex types like Error, Function, Map, and Set — without validating or sanitizing the input. An attacker can craft a malicious serialized payload that, when decoded, reconstructs a callable Function object from attacker-controlled data and invokes it, achieving arbitrary code execution. A public PoC was shared in the fix pull request, demonstrating exploitation via a crafted JSON string: replicator.decode('[{"@t":"[[Error]]","data":{"name":"Function","message":"require(\'child_process\').exec(\'open -a Calculator\')"}}}]')(), which spawns a system process (Github PR #19, Github Advisory). No authentication or special privileges are required; exploitation only requires that attacker-controlled data reaches a call to replicator.decode() (Github Advisory).

Successful exploitation allows an unauthenticated remote attacker to execute arbitrary operating system commands in the context of the Node.js process running the vulnerable application. This can result in full system compromise, unauthorized data access (confidentiality impact), data manipulation (integrity impact), lateral movement within the network, and potential deployment of malware or backdoors. Availability is not directly impacted per the CVSS scoring, but secondary effects such as service disruption from attacker actions remain a risk (Github Advisory, Feedly).

A functional proof-of-concept payload is publicly available in the GitHub pull request submitted by the vulnerability discoverer, demonstrating code execution via child_process.exec() (Github PR #19). However, there is no evidence of active in-the-wild exploitation or inclusion in exploit kits at this time, and the vulnerability has not been added to the CISA Known Exploited Vulnerabilities (KEV) catalog. The EPSS score is approximately 0.081–0.122%, placing it in the lower percentiles for near-term exploitation likelihood (Github Advisory). No specific threat actor attribution has been reported.

1. Identify target applications: Locate Node.js applications that use the replicator npm package (version ≤ 1.0.5) and expose an endpoint that passes user-controlled input to replicator.decode() — for example, via HTTP request body, query parameters, or WebSocket messages.
2. Craft malicious payload: Construct a serialized JSON string that abuses the [[Error]] type tag to inject a Function constructor with a malicious command as the message body, e.g.:

[{"@t":"[[Error]]","data":{"name":"Function","message":"require('child_process').exec('id > /tmp/pwned')"}}]

3. Deliver payload: Send the crafted payload to the vulnerable endpoint via HTTP POST or other applicable transport mechanism, ensuring it is passed as input to replicator.decode().
4. Trigger execution: The decode() function reconstructs the Function object from the attacker-supplied name and message fields; calling the returned function (or relying on application logic to invoke it) executes the embedded OS command on the server.
5. Achieve objective: Use the established code execution to exfiltrate data, establish a reverse shell, or perform lateral movement within the target environment (Github PR #19, Github Advisory).

• Network: Unexpected outbound connections from the Node.js application process to external IPs (e.g., reverse shell callbacks); HTTP requests containing JSON payloads with @t, [[Error]], or Function type markers in body or parameters.
• Logs: Application or web server access logs showing requests with encoded or raw JSON payloads containing "@t":"[[Error]]" or "name":"Function" patterns; Node.js error logs referencing unexpected child_process or exec calls.
• File System: Unexpected files created in world-writable directories (e.g., /tmp/) by the Node.js process; new scripts, cron jobs, or SSH authorized keys added by the application service account.
• Process: Unusual child processes spawned by the Node.js runtime (e.g., sh, bash, curl, wget, python) that are not part of normal application behavior (Github PR #19).

No officially patched version of the replicator npm package has been released as of the advisory date; the GitHub Advisory lists affected versions as ≤ 1.0.5 with no patched version available (Github Advisory). Organizations should immediately audit all applications for use of the replicator package and, where possible, replace it with a safer serialization alternative or implement strict input validation before passing any user-controlled data to replicator.decode(). As an interim measure, restrict network access to affected application endpoints to trusted sources only, and monitor application logs for suspicious serialized payloads.

The vulnerability was reported by researcher MorielHarush, who submitted a pull request to the replicator repository with a fix and a working PoC, and published a detailed write-up on their blog (Github PR #19). Red Hat acknowledged the CVE in their security advisory tracker (Red Hat CVE). Community reaction has been limited given the relatively low popularity of the package (25 stars on GitHub); no significant media coverage or broader security community discussion has been observed.