CVE-2026-26974

The record

Slyde is a program that creates animated presentations from XML. In versions 0.0.4 and below, Node.js automatically imports **/*.plugin.{js,mjs} files including those from node_modules, so any malicious package with a .plugin.js file can execute arbitrary code when installed or required. All projects using this loading behavior are affected, especially those installing untrusted packages. This issue has been fixed in version 0.0.5. To workaround this issue, users can audit and restrict which packages are installed in node_modules.

Affected packages

Related vulnerabilities

• GHSA-w7h5-55jg-cq2f Improper Control of Generation of Code ('Code Injection') in @tygo-van-den-hurk/slyde Same vulnerability
• CVE-2026-114727 Roundcube Webmail before 1.6.20 and 1.7.x before 1.7.5 passes potentially unsafe content… CWE-829
• CVE-2026-0303 A code execution vulnerability in Palo Alto Networks Checkov by Prisma® Cloud can allow… CWE-829
• CVE-2026-79721 Code execution can occur in versions of the MLflow platform running version 0.0.1 or… CWE-829
• CVE-2026-86504 In JetBrains IntelliJ IDEA before 2026.2.2 missing project-trust confirmation before… CWE-829
• CVE-2026-18252 GitLab has remediated an issue in GitLab EE affecting all versions from 18.9 before… CWE-829
• CVE-2026-76139 A flaw was found in acm-operator-bundle. CWE-829
• CVE-2026-22306 Download of code without integrity check, inclusion of functionality from untrusted… CWE-829