{"cve":"CVE-2026-26974","nvd":{"published":"2026-02-20T01:16:00.107","modified":"2026-06-17T10:26:28.200","status":"Analyzed","description":"Slyde is a program that creates animated presentations from XML. In versions 0.0.4 and below, Node.js automatically imports **/*.plugin.{js,mjs} files including those from node_modules, so any malicious package with a .plugin.js file can execute arbitrary code when installed or required. All projects using this loading behavior are affected, especially those installing untrusted packages. This issue has been fixed in version 0.0.5. To workaround this issue, users can audit and restrict which packages are installed in node_modules.","cvss_v4":{"vector":"CVSS:4.0/AV:N/AC:H/AT:N/PR:N/UI:P/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N","score":7.6},"cvss_v3":{"version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","score":9.8},"cwes":["CWE-829"],"references":["https://github.com/Tygo-van-den-Hurk/Slyde/commit/e4c215b061e44fd2ead805de34d72642a710af60","https://github.com/Tygo-van-den-Hurk/Slyde/releases/tag/v0.0.5","https://github.com/Tygo-van-den-Hurk/Slyde/security/advisories/GHSA-w7h5-55jg-cq2f"],"products":["slyde.js:slyde"],"source":"nvd","synced_at":"2026-10-19T22:23:35.260773158+00:00"},"epss":{"cve":"CVE-2026-26974","score":0.00608,"percentile":0.49131,"date":"2026-10-31"},"kev":null,"osv":[{"id":"GHSA-w7h5-55jg-cq2f","url":"https://osv.dev/vulnerability/GHSA-w7h5-55jg-cq2f","summary":"Improper Control of Generation of Code ('Code Injection') in @tygo-van-den-hurk/slyde","modified":"2026-02-20T17:03:01.473496Z","packages":[{"ecosystem":"npm","name":"@tygo-van-den-hurk/slyde","purl":"pkg:npm/%40tygo-van-den-hurk/slyde","ranges":["<0.0.5"],"fixed":["0.0.5"]}]}],"attribution":["This product uses the NVD API but is not endorsed or certified by the NVD.","EPSS scores: FIRST Exploit Prediction Scoring System, https://www.first.org/epss","Known exploited vulnerabilities: CISA Known Exploited Vulnerabilities Catalog, https://www.cisa.gov/known-exploited-vulnerabilities-catalog","Package advisories: OSV (https://osv.dev), from the GitHub Advisory Database, PyPA, Go, RustSec and other ecosystem databases, under CC-BY 4.0 or CC0","CVE records: the CVE Program's CVE List (https://www.cve.org), under its terms of use (https://www.cve.org/Legal/TermsOfUse). CVE is a registered trademark of The MITRE Corporation; this product is not affiliated with the CVE Program."]}