CVE-2026-26974: 
JavaScript vulnerability analysis and mitigation

CVE-2026-26974 is a remote code execution (RCE) vulnerability in Slyde, a Node.js program for creating animated presentations from XML. In versions 0.0.4 and below, Slyde automatically imports all files matching glob patterns such as **/*.plugin.{js,mjs}, **/*.plugins.{js,mjs}, and **/*.slyde.{js,mjs} — including those residing in the node_modules directory — allowing any malicious npm package containing a matching file to execute arbitrary code upon installation or when the module is required. The vulnerability was published on February 16, 2026, and added to the GitHub Advisory Database on February 18, 2026. It carries a CVSS v3.1 base score of 9.8 (Critical) and a CVSS v4.0 base score of 7.6 (High) (GitHub Advisory, Slyde Advisory).

The root cause is classified as CWE-829 (Inclusion of Functionality from Untrusted Control Sphere), with a secondary reference to CWE-94 (Improper Control of Generation of Code). In src/commands/base.ts, Slyde's plugin-loading logic used FastGlob to resolve a broad set of default glob patterns — including **/*.plugin.{js,mjs} and **/*.slyde.{js,mjs} — without excluding the node_modules directory. As a result, any npm package installed in the project that contains a file matching these patterns would be automatically imported and executed with the privileges of the Node.js process. The fix in commit e4c215b narrowed the default glob to plugins/**.slyde.{js,mjs}, which does not traverse node_modules (Patch Commit, GitHub Advisory).

Successful exploitation allows an attacker to achieve arbitrary code execution on any system running a vulnerable version of Slyde (≤ 0.0.4) that has a malicious package installed in its node_modules directory. The malicious code executes with the full privileges of the Node.js process, enabling complete system compromise, data exfiltration, installation of persistent backdoors, and lateral movement within the network. Confidentiality and integrity of the affected system are both rated High impact, making this a severe supply-chain attack vector for any project using untrusted npm dependencies (GitHub Advisory, Feedly).

No public proof-of-concept exploit code has been identified, and there is no evidence of active in-the-wild exploitation at this time. The EPSS score is approximately 0.06% (0.034% per GitHub Advisory), placing it in a low percentile for near-term exploitation probability. The vulnerability is not currently listed in the CISA Known Exploited Vulnerabilities (KEV) catalog. No threat actor attribution has been reported (GitHub Advisory, Feedly).

1. Identify a target: Locate a project using @tygo-van-den-hurk/slyde version 0.0.4 or below, particularly one that installs packages from public or untrusted npm registries.
2. Craft a malicious npm package: Create an npm package that includes a file named with a pattern matching Slyde's auto-import globs (e.g., anything.plugin.js, anything.slyde.js, or anything.plugins.mjs) containing arbitrary JavaScript payload (e.g., a reverse shell, data exfiltration script, or backdoor installer).
3. Deliver the malicious package: Publish the package to the npm registry (typosquatting a popular dependency), or compromise an existing dependency via a supply-chain attack, so that the target project installs it into node_modules.
4. Trigger execution: When the victim runs Slyde (e.g., slyde build), the FastGlob pattern **/*.plugin.{js,mjs} resolves files within node_modules, causing the malicious .plugin.js file to be automatically imported and executed with the privileges of the Node.js process.
5. Achieve objective: The attacker's payload executes — enabling data exfiltration, reverse shell establishment, persistence mechanisms, or further lateral movement within the victim's environment (GitHub Advisory, Patch Commit).

• File System: Unexpected .plugin.js, .plugins.js, .plugin.mjs, .plugins.mjs, or .slyde.js/.slyde.mjs files present within any subdirectory of node_modules in a Slyde project; newly created or modified files in sensitive directories (e.g., cron jobs, SSH authorized_keys, startup scripts) attributable to the Node.js process.
• Process: Unusual child processes spawned by the Node.js/Slyde process (e.g., bash, sh, curl, wget, python, nc) that are not part of normal Slyde operation; unexpected outbound network connections originating from the Node.js process.
• Network: Outbound connections from the Slyde host to unknown or suspicious IP addresses/domains, particularly on non-standard ports, following a slyde command execution.
• Logs: Node.js or system logs showing import/require of files from within node_modules matching plugin glob patterns; npm install logs referencing unfamiliar or recently added packages with .plugin.js files.

The vulnerability is fixed in Slyde version 0.0.5, which restricts the default plugin glob to plugins/**.slyde.{js,mjs}, explicitly excluding node_modules. Users should upgrade immediately from any version ≤ 0.0.4 to version 0.0.5 or later. As a workaround for those unable to upgrade immediately, audit and restrict all packages installed in node_modules, use package lock files (package-lock.json or yarn.lock) to pin dependency versions, and consider using private package registries or vendoring dependencies to control the supply chain (Slyde v0.0.5 Release, GitHub Advisory).

The vulnerability was self-reported and patched by the project maintainer (Tygo-van-den-Hurk) on the same day (February 16, 2026), demonstrating responsible disclosure practices. The repository has since been archived by the owner as of June 10, 2026. No significant broader community commentary, media coverage, or notable researcher reactions have been identified beyond standard vulnerability database aggregation (Slyde Advisory).