Skip to content
Patch Next
Sign inAdd to your agent

← Public intelligence

npm package

@tygo-van-den-hurk/slyde

Open actionable advisories and recorded vendor fixes. This public package view has no inventory attached and cannot establish whether your deployment is affected. A vendor fix never resolves your finding; verify your installed version and the source guidance.

Open advisories

1 actionable advisory, newest first. Withdrawn advisories and news are excluded. Coverage is partial.

  1. High, CVSS 7.6npmAmendedPublished

    Improper Control of Generation of Code ('Code Injection') in @tygo-van-den-hurk/slyde

    CVE-2026-26974 · GHSA-w7h5-55jg-cq2f

    Affected
    • npm @tygo-van-den-hurk/slyde < 0.0.5
    Fixed in
    0.0.5· Vendor fix available
    Issue
    Impact This is a remote code execution (RCE) vulnerability. Node.js automatically imports /.plugin.{js,mjs} files including those from nodemodules, so any malicious package with a .plugin.js file could execute arbitrary code when installed or required. All projects using this loading behavior are affected, especially those installing untrusted packages. Patches The issue has been patched in v0.0.5. Users should upgrade to v0.0.5 or later to mitigate the vulnerability. Workarounds - Audit and restrict which packages are installed in nodemodules. References - CWE-94: Improper Control of Generation of Code - GitHub Security Advisories documentation: https://docs.github.com/en/code-security/security-advisories

    Recommended action: Upgrade to 0.0.5 or later, then redeploy and verify.A vendor fix does not resolve your finding until you verify it in your own systems.

    Sources:osv.dev (1)github.com (2)Source checked Evidence →