CVE-2026-26974: Code Injection Vulnerability in @tygo-van-den-hurk/slyde
Summary
CVE-2026-26974: Improper Control of Generation of Code ('Code Injection') in @tygo-van-den-hurk/slyde. Affects @tygo-van-den-hurk/slyde versions < 0.0.5. Fixed in 0.0.5. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
The package @tygo-van-den-hurk/slyde is a Node.js library designed for seamless integration and functionality within JavaScript applications. It allows developers to utilize various plugins to extend its capabilities. However, due to its loading behavior, it is susceptible to vulnerabilities that can lead to remote code execution, especially when untrusted packages are installed.
Vulnerability Detail
This vulnerability is classified as a remote code execution (RCE) issue, stemming from improper control over the generation of code. Node.js automatically imports files with the extension .plugin.js or .plugin.mjs from the node_modules directory. If a malicious package includes such a file, it can execute arbitrary code upon installation or when required in an application. This poses a significant risk to all projects utilizing this loading behavior, particularly those that install untrusted packages.
How To Fix
Minimum fixed version
0.0.5
This is the first release that contains the fix.
npm install @tygo-van-den-hurk/slyde@0.0.5Tip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
As a temporary measure, users can audit and restrict the packages installed in the node_modules directory to minimize the risk of executing malicious code. This involves reviewing the dependencies and ensuring that only trusted packages are included.
Conclusion
The CVE-2026-26974 vulnerability in the @tygo-van-den-hurk/slyde package poses a significant risk of remote code execution. Users are strongly advised to upgrade to version 0.0.5 or later to mitigate this issue. Additionally, auditing installed packages can help reduce exposure to potential threats.
See every vulnerability recorded for @tygo-van-den-hurk/slyde →
FAQ
The vulnerability allows for remote code execution due to improper control over code generation in the @tygo-van-den-hurk/slyde package.
You can use Vulert, which monitors and alerts for open-source vulnerabilities in real-time. You can check your application using the Vulert playground without any signup.
The CVSS score for this vulnerability is 7.6, indicating a high severity level.
If an immediate upgrade is not possible, consider auditing your installed packages and restricting the use of untrusted packages as a temporary workaround.
Additional details can be found in the GitHub Security Advisories documentation and the CWE-94 reference.
