CVE-2026-26974 is a critical (CVSS 9.8) code execution flaw in Slyde 0.0.4 and below. Slyde automatically imports plugin files, including ones inside node_modules, so a malicious package can run code when installed or required. Version 0.0.5 fixes it. Upgrade and audit what sits in node_modules.
What's affected
Slyde versions 0.0.4 and below, a program that builds animated presentations from XML. The advisory says projects using this loading behavior are affected, especially those that install untrusted packages.
The fix is in Slyde 0.0.5, per the project's release page and GitHub advisory GHSA-w7h5-55jg-cq2f.
How to check if you're exposed
Check which version of Slyde you have and where it sits in the tree:
npm ls --all | grep -i slyde
Then look for stray plugin files in installed packages, for example with find node_modules -name "*.plugin.js" and the mjs variant. Any hit you did not expect deserves a look. Safeguard has a free in-browser dependency scan at https://gold.safeguard.sh/scan that checks a dependency file against known CVEs.
What to do now
- Upgrade Slyde to 0.0.5 or later.
- Audit node_modules for .plugin.js and .plugin.mjs files and check that each belongs to a package you meant to install.
- Remove packages you cannot account for and reinstall from a lockfile.
- Limit installs to packages you trust, which is the workaround the advisory gives.
- Pin versions and review lockfile changes in code review so new packages do not slip in.
Why it matters
The weakness is CWE-829, inclusion of functionality from an untrusted control sphere. Slyde looked for plugin files with a broad pattern and loaded anything that matched, so code from any installed package could run without the user choosing it.
This ties to a wider supply chain lesson. Installing a dependency already means trusting it to run code, and a tool that auto loads files by name widens that trust to every package in the tree. The record does not mark this CVE as known exploited.
Try it yourself
Click through it at your own pace, or open it full screen.
Quick check
What is the vulnerable behavior?
Slyde imports any file matching the plugin naming pattern, including files from node_modules, so a malicious package can ship one and have it run.
Sources
- CVE-2026-26974 on Gold
- Fixed release listed in the record: https://github.com/Tygo-van-den-Hurk/Slyde/releases/tag/v0.0.5
- GitHub advisory listed in the record: https://github.com/Tygo-van-den-Hurk/Slyde/security/advisories/GHSA-w7h5-55jg-cq2f
Last reviewed: 19 October 2026.
