PT-2026-20786 · Node.Js+1 · Node.Js+1

Tygo-Van-Den-Hurk · Publicado 2026-02-18 · Atualizado 2026-03-02 · CVE-2026-26974

Positive Technologies (AI Summary)

CVSS v3.1

9.8

Crítica

Vetor base

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions Slyde versions 0.0.4 and below

Description Slyde is a program used to create animated presentations from XML. A remote code execution issue exists because Node.js automatically imports **/*.plugin.{js,mjs} files, including those from node modules. This allows any malicious package containing a .plugin.js file to execute arbitrary code when installed or required. All projects utilizing this loading behavior are affected, particularly those installing packages from untrusted sources.

Recommendations Upgrade to version 0.0.5 or later. Audit and restrict which packages are installed in node modules.

Exploit

Correção

Enumeração de Fraquezas

CWE-829

Identificadores relacionados

CVE-2026-26974

GHSA-W7H5-55JG-CQ2F

Produtos afetados

Node.Js

Slyde

Referências · 12

• 🔥 https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/26xxx/CVE-2026-26974.json · Exploit
• https://github.com/Tygo-van-den-Hurk/Slyde/commit/e4c215b061e44fd2ead805de34d72642a710af60 · Correção
• https://github.com/Tygo-van-den-Hurk/Slyde/security/advisories/GHSA-w7h5-55jg-cq2f · Aviso do Fabricante
• https://github.com/Tygo-van-den-Hurk/Slyde · Nota
• https://github.com/Tygo-van-den-Hurk/Slyde/releases/tag/v0.0.5 · Nota
• https://osv.dev/vulnerability/GHSA-w7h5-55jg-cq2f · Aviso do Fabricante
• https://t.me/cveNotify/152551 · Publicação no Telegram
• https://nvd.nist.gov/vuln/detail/CVE-2026-26974 · Nota de Segurança
• https://t.me/CVEtracker/45221 · Publicação no Telegram
• https://t.me/cveNotify/153743 · Publicação no Telegram
• https://twitter.com/VulmonFeeds/status/2024714679193338344 · Publicação no Twitter
• https://osv.dev/vulnerability/CVE-2026-26974 · Aviso do Fabricante