CVE-2026-26974 json
Sylde has Improper Control of Generation of Code
published 2026-02-18 8 mo ago modified 2026-06-17 4 mo ago also GHSA-w7h5-55jg-cq2f , EUVD-2026-8403
- cvss
- 9.8
- version 3.1, NVD
- cisa kev
- Not listed
- not in CISA's catalog
- epss
- 0.6%
- EPSS 0.6% chance of exploitation in 30 days, percentile 49%
- public exploits
- 0
- none known
Summary
Slyde is a program that creates animated presentations from XML. In versions 0.0.4 and below, Node.js automatically imports **/*.plugin.{js,mjs} files including those from node_modules, so any malicious package with a .plugin.js file can execute arbitrary code when installed or required. All projects using this loading behavior are affected, especially those installing untrusted packages. This issue has been fixed in version 0.0.5. To workaround this issue, users can audit and restrict which packages are installed in node_modules.
Patch / fix
- npm @tygo-van-den-hurk/slyde 0.0.5
- slyde.js slyde 0.0.5
CISA SSVC
- Exploitation
- none
- Automatable
- no
- Technical impact
- partial
- Assessed
- 8 mo ago
Exploit prediction
0.61% chance of exploitation in the next 30 days, higher than 49% of all scored CVEs (FIRST EPSS, 2026-11-08).
CVSS scores
| assigned by | version | score | vector |
|---|---|---|---|
| CNA | 4.0 | 7.6 | CVSS:4.0/AV:N/AC:H/AT:N/PR:N/UI:P/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N |
| CNA | 4.0 | 7.6 | CVSS:4.0/AV:N/AC:H/AT:N/PR:N/UI:P/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X |
| NVD | 3.1 | 9.8 | CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H |
Affected packages
| ecosystem | package | affected | fixed in |
|---|---|---|---|
| npm | @tygo-van-den-hurk/slyde | <0.0.5 |
0.0.5 |
Affected products
- Tygo-van-den-Hurk Slyde
Classification
- Weakness
-
- CWE-829 Inclusion of Functionality from Untrusted Control Sphere
References
-
github.com
/Tygo-van-den-Hurk/Slyde/commit/e4c215b061e44fd2ead805de34d72642a710af60
web, patch
-
github.com
/Tygo-van-den-Hurk/Slyde/security/advisories/GHSA-w7h5-55jg-cq2f
web, vendor-advisory
-
github.com
/Tygo-van-den-Hurk/Slyde/releases/tag/v0.0.5
web, product, release-notes
-
nvd.nist.gov
/vuln/detail/CVE-2026-26974
advisory
-
github.com
/Tygo-van-den-Hurk/Slyde
package
Sources
- CVE List CVE-2026-26974
- GitHub Advisory GHSA-w7h5-55jg-cq2f
- NVD CVE-2026-26974
Fencer Vulns keeps one entry per vulnerability: the CVE id wins, then GHSA, and records that alias each other are merged, except that two CVEs always keep separate entries. The same data is available as JSON.