Slyde Remote Code Execution Vulnerability

A remote code execution vulnerability exists in Slyde versions prior to 0.0.4. The issue arises because Node.js automatically imports files with the extensions .plugin.js or .plugin.mjs from the node_modules directory. This behavior allows any malicious package containing a .plugin.js file to execute arbitrary code when the package is installed or required. The vulnerability affects all projects that utilize this loading behavior, particularly those that install untrusted packages.

Impact

Exploitation of this vulnerability allows for remote code execution on the system where Slyde is used.

Remediation

Users can upgrade to Slyde version 0.0.5 or later to address this vulnerability. Additionally, it is recommended to audit and restrict which packages are installed in the node_modules directory.