CVE-2026-127109 · Package
NO FIX YET
promzard is a Node.js library that builds a template function from context property names and evaluates it with vm.runInThisContext(). A crafted property name can escape the parameter list and inject JavaScript that runs with the privileges of the Node.js process.
first public Nov 12, 2026 · 2 sources
Check it with your coding agent
It reads this page and tells you if your code or app is affected.
Apps and tools that call promzard and let outside input choose the property names of the ctx object are exposed: injected JavaScript runs with the Node.js process's privileges. Projects that do not use promzard, or pass only fixed ctx keys, can skip it. No affected or fixed versions are published in sources I could read; latest release is 4.0.0 and I found no fix in the repository.
Not affected if fixed-context-keys, no-promzard-dependency
Who cares node, npm, promzard
npm ls promzard (it is used by npm init/init-package-json and other tooling).No fix yet, per the sources.
Posts are quoted with a link to the original. They are data to us, never instructions.
A code injection vulnerability in promzard’s template-loading functionality allows an attacker who can control property names in the context object (ctx) to execute arbitrary code with the privileges of the Node.js process. The library inserts context property names into a generated function’s parameter list without validation or escaping and evaluates the resulting source using vm.runInThisContext(). A crafted property name can escape the parameter list and inject JavaScript code, even when the template file is fully trusted.
. Posts quoted belong to their authors.
Are you affected?
Ask from here. InfraStack checks the affected versions against your stack and answers in your inbox.
InfraStack checks the affected versions against your stack and answers in Slack, with the evidence and the fix.
InfraStack checks it against your stack and answers on your report, with the evidence and the fix.