Executive brief
Replicator is a widely-used npm serialization library (~1M monthly downloads) that reconstructs JavaScript objects from encoded data. A vulnerability in how it deserializes error objects allows an attacker to specify any global constructor by name, leading to remote code execution without authentication. Applications using Replicator to decode untrusted data—such as from network requests or stored inputs—are at risk of complete compromise.
Technical details
The vulnerability is a CWE-502 unsafe deserialization flaw in Replicator's decode function. When reconstructing [[Error]] objects, the library uses the untrusted "name" field from serialized input to perform a direct global scope lookup (var Ctor = GLOBAL[val.name] || Error), allowing an attacker to select constructors like Function and inject code as the message parameter. An unauthenticated attacker can craft a malicious serialized payload and pass it to replicator.decode(), which if invoked as a function, executes arbitrary JavaScript. No authentication, user interaction, or special permissions are required; the attack only requires network access to send data to an application using Replicator's decode method on untrusted input. The fix (PR #19) implements an allowlist of safe error constructors (Error, EvalError, RangeError, ReferenceError, SyntaxError, TypeError, URIError) and defaults to Error for unknown names, eliminating the open-ended global lookup.
Affected products
- npm replicator 1.0.5 and earlier
Timeline
- 2026-01-29: disclosed: Vulnerability reported
- 2026-02-05: advisory: PR #19 introduced with constructor allowlist fix
- 2026-02-05: patched: Fix merged as PR #19
- 2026-02-10: other: CVE-2026-2265 assigned
- 2026-04-01: advisory: Public advisory published