An unauthenticated remote code execution vulnerability exists in the Replicator 1.0.5 npm package. The flaw arises when the application blindly deserializes untrusted user input, allowing an attacker to construct an object that triggers arbitrary code execution upon deserialization.

The affected product is Replicator, version 1.0.5, used as a Node.js package manager. Systems incorporating this specific version are at risk; newer or older versions are not indicated as affected by the available data.

The CVSS score of 6.5 indicates a moderate severity, while no EPSS score is available and the vulnerability is not listed in the CISA KEV catalog. The attack vector is inferred to be remote and unauthenticated, as the description states that the flaw is triggered by deserializing untrusted user input. Successful exploitation would enable an attacker to run arbitrary code with the privileges of the application, compromising confidentiality, integrity, and availability of affected systems.