7.6

CVSS Score

4.0

-

CVSS Score

Basic Information

Concerned about an active attack path?

Talk to our security experts and see Miggo in action.

Miggo Vulnerability Database

→

CVE-2026-26974

CVE-2026-26974: Sylde has Improper Control of Generation of Code

Slyde is a program that creates animated presentations from XML. In versions 0.0.4 and below, Node.js automatically imports **/*.plugin.{js,mjs} files including those from node_modules, so any malicious package with a .plugin.js file can execute arbitrary code when installed or required. All projects using this loading behavior are affected, especially those installing untrusted packages. This issue has been fixed in version 0.0.5. To workaround this issue, users can audit and restrict which packages are installed in node_modules.

(GitHub Advisory)

Miggo Vulnerability Database

→

CVE-2026-26974

CVE-2026-26974:

7.6

CVSS Score

4.0

-

CVSS Score

Basic Information

Is this CVE running in your environment?

Easily map the attack path and prioritize which CVEs are a threat to your organization

Validate Exposure

Technical Details

Package Name	Ecosystem	Vulnerable Versions	First Patched Version
@tygo-van-den-hurk/slyde	npm	< 0.0.5	0.0.5

Technical Details

Vulnerability Intelligence
Miggo AI

Root Cause Analysis

The vulnerability lies in the command-line interface definition in 'src/commands/base.ts'. The application uses the 'yargs' library to parse command-line arguments. For the '--plugin' option, a 'coerce' function is defined to process the input. This function uses 'FastGlob.sync' to find files matching given glob patterns. The vulnerability was introduced by providing a set of default glob patterns that were too permissive, such as '/*.plugin.{js,mjs}'. This allowed any package in 'node_modules' containing a file with a '.plugin.js' extension to be automatically loaded and executed when the 'slyde' application was run, leading to remote code execution. The patch mitigates this by restricting the default glob pattern to a much more specific 'plugins/.slyde.{js,mjs}', which is less likely to unintentionally match files in 'node_modules'. The vulnerable function is the anonymous 'coerce' callback that executes the file search with these dangerous default patterns.

Vulnerable functions

(anonymous function)

src/commands/base.ts

An anonymous function is used as the 'coerce' callback for the 'plugin' option in the yargs-based command-line interface. This function uses 'FastGlob.sync' to find files based on glob patterns. The vulnerability was triggered because the default glob patterns were overly broad (e.g., '**/*.plugin.{js,mjs}'), causing the application to search for and subsequently load malicious JavaScript files from untrusted directories like 'node_modules' when the 'slyde' command was executed.

Vulnerability Intelligence
Miggo AI

Unlock WAF rules for this CVE

Generate vendor-ready rules for the observed attack patterns, plus reasoning and safe deployment guidance

Get WAF rules

WAF Protection Rules

WAF Rule

W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.

Reasoning

*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.