{"id":"CVE-2026-26974","aliases":["GHSA-w7h5-55jg-cq2f"],"url":"https://o3.security/vulnerability/CVE-2026-26974","summary":"Sylde has Improper Control of Generation of Code","details":"### Impact\nThis is a **remote code execution (RCE) vulnerability**. Node.js automatically imports `**/*.plugin.{js,mjs}` files including those from `node_modules`, so any malicious package with a `.plugin.js` file could execute arbitrary code when installed or required. **All projects using this loading behavior are affected**, especially those installing untrusted packages.\n\n### Patches\nThe issue has been **patched in v0.0.5**. Users should upgrade to **v0.0.5 or later** to mitigate the vulnerability.\n\n### Workarounds\n- Audit and restrict which packages are installed in `node_modules`.\n\n### References\n- [CWE-94: Improper Control of Generation of Code](https://cwe.mitre.org/data/definitions/94.html)  \n- GitHub Security Advisories documentation: [https://docs.github.com/en/code-security/security-advisories](https://docs.github.com/en/code-security/security-advisories)","published":"2026-02-20T00:34:37.915Z","modified":"2026-08-12T03:51:46.516609827Z","cvss":null,"epss":{"score":0.0054,"percentile":0.43001,"asOf":"2026-08-24"},"cisaKev":null,"exploitsKnown":0,"affectedPackages":[{"ecosystem":"npm","name":"@tygo-van-den-hurk/slyde","fixedVersion":"0.0.5"}],"fix":{"url":"https://github.com/Tygo-van-den-Hurk/Slyde/commit/e4c215b061e44fd2ead805de34d72642a710af60","label":"Tygo-van-den-Hurk/Slyde@e4c215b"},"references":[{"type":"WEB","url":"https://github.com/Tygo-van-den-Hurk/Slyde/releases/tag/v0.0.5"},{"type":"ADVISORY","url":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/26xxx/CVE-2026-26974.json"},{"type":"ADVISORY","url":"https://github.com/Tygo-van-den-Hurk/Slyde/security/advisories/GHSA-w7h5-55jg-cq2f"},{"type":"ADVISORY","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-26974"},{"type":"FIX","url":"https://github.com/Tygo-van-den-Hurk/Slyde/commit/e4c215b061e44fd2ead805de34d72642a710af60"},{"type":"PACKAGE","url":"https://github.com/Tygo-van-den-Hurk/Slyde"}],"provenance":{"sources":["OSV.dev","FIRST.org (EPSS)"],"lastVerified":"2026-08-12T03:51:46.516609827Z"}}