PT-2026-20786 · Node.Js+1 · Node.Js+1

Tygo-Van-Den-Hurk · Published 2026-02-18 · Updated 2026-03-02 · CVE-2026-26974

Positive Technologies (AI Summary)

CVSS v3.1

9.8

Critical

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions Slyde versions 0.0.4 and below

Description Slyde is a program used to create animated presentations from XML. A remote code execution issue exists because Node.js automatically imports **/*.plugin.{js,mjs} files, including those from node modules. This allows any malicious package containing a .plugin.js file to execute arbitrary code when installed or required. All projects utilizing this loading behavior are affected, particularly those installing packages from untrusted sources.

Recommendations Upgrade to version 0.0.5 or later. Audit and restrict which packages are installed in node modules.

Exploit

Fix

Weakness Enumeration

CWE-829

Related Identifiers

CVE-2026-26974

GHSA-W7H5-55JG-CQ2F

Affected Products

Node.Js

Slyde

References · 12

• 🔥 https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/26xxx/CVE-2026-26974.json · Exploit
• https://github.com/Tygo-van-den-Hurk/Slyde/commit/e4c215b061e44fd2ead805de34d72642a710af60 · Patch
• https://github.com/Tygo-van-den-Hurk/Slyde/security/advisories/GHSA-w7h5-55jg-cq2f · Vendor Advisory
• https://osv.dev/vulnerability/GHSA-w7h5-55jg-cq2f · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2026-26974 · Security Note
• https://osv.dev/vulnerability/CVE-2026-26974 · Vendor Advisory
• https://github.com/Tygo-van-den-Hurk/Slyde · Note
• https://github.com/Tygo-van-den-Hurk/Slyde/releases/tag/v0.0.5 · Note
• https://t.me/cveNotify/152551 · Telegram Post
• https://t.me/CVEtracker/45221 · Telegram Post
• https://t.me/cveNotify/153743 · Telegram Post
• https://twitter.com/VulmonFeeds/status/2024714679193338344 · Twitter Post