Vulnerability-Lookup

GHSA-W7H5-55JG-CQ2F

Vulnerability from github – Published: 2026-02-18 21:45 – Updated: 2026-02-20 16:48

Summary

Improper Control of Generation of Code ('Code Injection') in @tygo-van-den-hurk/slyde

Details

Impact

This is a remote code execution (RCE) vulnerability. Node.js automatically imports **/*.plugin.{js,mjs} files including those from node_modules, so any malicious package with a .plugin.js file could execute arbitrary code when installed or required. All projects using this loading behavior are affected, especially those installing untrusted packages.

Patches

The issue has been patched in v0.0.5. Users should upgrade to v0.0.5 or later to mitigate the vulnerability.

Workarounds

Audit and restrict which packages are installed in node_modules.

References

CWE-94: Improper Control of Generation of Code
GitHub Security Advisories documentation: https://docs.github.com/en/code-security/security-advisories

Severity ?

7.6 (High)


                  
                    CVSS:4.0/AV:N/AC:H/AT:N/PR:N/UI:P/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N

Show details on source website

JSON

To clipboard

{
  "affected": [
    {
      "package": {
        "ecosystem": "npm",
        "name": "@tygo-van-den-hurk/slyde"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "0"
            },
            {
              "fixed": "0.0.5"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ]
    }
  ],
  "aliases": [
    "CVE-2026-26974"
  ],
  "database_specific": {
    "cwe_ids": [
      "CWE-829"
    ],
    "github_reviewed": true,
    "github_reviewed_at": "2026-02-18T21:45:06Z",
    "nvd_published_at": "2026-02-20T01:16:00Z",
    "severity": "HIGH"
  },
  "details": "### Impact\nThis is a **remote code execution (RCE) vulnerability**. Node.js automatically imports `**/*.plugin.{js,mjs}` files including those from `node_modules`, so any malicious package with a `.plugin.js` file could execute arbitrary code when installed or required. **All projects using this loading behavior are affected**, especially those installing untrusted packages.\n\n### Patches\nThe issue has been **patched in v0.0.5**. Users should upgrade to **v0.0.5 or later** to mitigate the vulnerability.\n\n### Workarounds\n- Audit and restrict which packages are installed in `node_modules`.\n\n### References\n- [CWE-94: Improper Control of Generation of Code](https://cwe.mitre.org/data/definitions/94.html)  \n- GitHub Security Advisories documentation: [https://docs.github.com/en/code-security/security-advisories](https://docs.github.com/en/code-security/security-advisories)",
  "id": "GHSA-w7h5-55jg-cq2f",
  "modified": "2026-02-20T16:48:00Z",
  "published": "2026-02-18T21:45:06Z",
  "references": [
    {
      "type": "WEB",
      "url": "https://github.com/Tygo-van-den-Hurk/Slyde/security/advisories/GHSA-w7h5-55jg-cq2f"
    },
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-26974"
    },
    {
      "type": "WEB",
      "url": "https://github.com/Tygo-van-den-Hurk/Slyde/commit/e4c215b061e44fd2ead805de34d72642a710af60"
    },
    {
      "type": "PACKAGE",
      "url": "https://github.com/Tygo-van-den-Hurk/Slyde"
    },
    {
      "type": "WEB",
      "url": "https://github.com/Tygo-van-den-Hurk/Slyde/releases/tag/v0.0.5"
    }
  ],
  "schema_version": "1.4.0",
  "severity": [
    {
      "score": "CVSS:4.0/AV:N/AC:H/AT:N/PR:N/UI:P/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N",
      "type": "CVSS_V4"
    }
  ],
  "summary": "Improper Control of Generation of Code (\u0027Code Injection\u0027) in @tygo-van-den-hurk/slyde"
}

CVE-2026-26974 (GCVE-0-2026-26974)

Vulnerability from cvelistv5 – Published: 2026-02-20 00:34 – Updated: 2026-02-20 15:36

Title

Sylde has Improper Control of Generation of Code

Summary

Slyde is a program that creates animated presentations from XML. In versions 0.0.4 and below, Node.js automatically imports **/*.plugin.{js,mjs} files including those from node_modules, so any malicious package with a .plugin.js file can execute arbitrary code when installed or required. All projects using this loading behavior are affected, especially those installing untrusted packages. This issue has been fixed in version 0.0.5. To workaround this issue, users can audit and restrict which packages are installed in node_modules.

Severity ?

7.6 (High)


                        
                          CVSS:4.0/AV:N/AC:H/AT:N/PR:N/UI:P/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N

CWE

CWE-829 - Inclusion of Functionality from Untrusted Control Sphere

Assigner

GitHub_M

References

URL

Tags

	https://github.com/Tygo-van-den-Hurk/Slyde/securi…	x_refsource_CONFIRM
	https://github.com/Tygo-van-den-Hurk/Slyde/commit…	x_refsource_MISC
	https://github.com/Tygo-van-den-Hurk/Slyde/releas…	x_refsource_MISC

Impacted products

	Vendor	Product	Version
	Tygo-van-den-Hurk	Slyde	Affected: < 0.0.5

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "adp": [
      {
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2026-26974",
                "options": [
                  {
                    "Exploitation": "none"
                  },
                  {
                    "Automatable": "no"
                  },
                  {
                    "Technical Impact": "partial"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2026-02-20T15:26:39.347624Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2026-02-20T15:36:08.989Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "product": "Slyde",
          "vendor": "Tygo-van-den-Hurk",
          "versions": [
            {
              "status": "affected",
              "version": "\u003c 0.0.5"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "Slyde is a program that creates animated presentations from XML. In versions 0.0.4 and below, Node.js automatically imports **/*.plugin.{js,mjs} files including those from node_modules, so any malicious package with a .plugin.js file can execute arbitrary code when installed or required. All projects using this loading behavior are affected, especially those installing untrusted packages. This issue has been fixed in version 0.0.5. To workaround this issue, users can audit and restrict which packages are installed in node_modules."
        }
      ],
      "metrics": [
        {
          "cvssV4_0": {
            "attackComplexity": "HIGH",
            "attackRequirements": "NONE",
            "attackVector": "NETWORK",
            "baseScore": 7.6,
            "baseSeverity": "HIGH",
            "privilegesRequired": "NONE",
            "subAvailabilityImpact": "NONE",
            "subConfidentialityImpact": "NONE",
            "subIntegrityImpact": "NONE",
            "userInteraction": "PASSIVE",
            "vectorString": "CVSS:4.0/AV:N/AC:H/AT:N/PR:N/UI:P/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N",
            "version": "4.0",
            "vulnAvailabilityImpact": "NONE",
            "vulnConfidentialityImpact": "HIGH",
            "vulnIntegrityImpact": "HIGH"
          }
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-829",
              "description": "CWE-829: Inclusion of Functionality from Untrusted Control Sphere",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-02-20T00:34:37.915Z",
        "orgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
        "shortName": "GitHub_M"
      },
      "references": [
        {
          "name": "https://github.com/Tygo-van-den-Hurk/Slyde/security/advisories/GHSA-w7h5-55jg-cq2f",
          "tags": [
            "x_refsource_CONFIRM"
          ],
          "url": "https://github.com/Tygo-van-den-Hurk/Slyde/security/advisories/GHSA-w7h5-55jg-cq2f"
        },
        {
          "name": "https://github.com/Tygo-van-den-Hurk/Slyde/commit/e4c215b061e44fd2ead805de34d72642a710af60",
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://github.com/Tygo-van-den-Hurk/Slyde/commit/e4c215b061e44fd2ead805de34d72642a710af60"
        },
        {
          "name": "https://github.com/Tygo-van-den-Hurk/Slyde/releases/tag/v0.0.5",
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://github.com/Tygo-van-den-Hurk/Slyde/releases/tag/v0.0.5"
        }
      ],
      "source": {
        "advisory": "GHSA-w7h5-55jg-cq2f",
        "discovery": "UNKNOWN"
      },
      "title": "Sylde has Improper Control of Generation of Code"
    }
  },
  "cveMetadata": {
    "assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
    "assignerShortName": "GitHub_M",
    "cveId": "CVE-2026-26974",
    "datePublished": "2026-02-20T00:34:37.915Z",
    "dateReserved": "2026-02-16T22:20:28.612Z",
    "dateUpdated": "2026-02-20T15:36:08.989Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

Sightings

Author	Source	Type	Date

Nomenclature

Seen: The vulnerability was mentioned, discussed, or observed by the user.
Confirmed: The vulnerability has been validated from an analyst's perspective.
Published Proof of Concept: A public proof of concept is available for this vulnerability.
Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
Not confirmed: The user expressed doubt about the validity of the vulnerability.
Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.

Detection rules are retrieved from Rulezet.

Action not permitted

GHSA-W7H5-55JG-CQ2F

Impact

Patches

Workarounds

References

CVE-2026-26974 (GCVE-0-2026-26974)

Tags

Sightings

Nomenclature