{"id":"CVE-2026-127109","kind":"vulnerability","aliases":["CVE-2026-127109"],"related":[],"title":"promzard: crafted context property names let code run in Node","description":"A code injection vulnerability in promzard’s template-loading functionality allows an attacker who can control property names in the context object (ctx) to execute arbitrary code with the privileges of the Node.js process. The library inserts context property names into a generated function’s parameter list without validation or escaping and evaluates the resulting source using `vm.runInThisContext()`. A crafted property name can escape the parameter list and inject JavaScript code, even when the template file is fully trusted.","summary":"promzard is a Node.js library that builds a template function from context property names and evaluates it with vm.runInThisContext(). A crafted property name can escape the parameter list and inject JavaScript that runs with the privileges of the Node.js process.","severity":"high","cvss":null,"epss":null,"exploited":false,"exploited_at":null,"products":[],"ecosystems":[],"tags":["node","npm","package","promzard"],"not_affected_if":["fixed-context-keys","no-promzard-dependency"],"how_to_check":"- Run `npm ls promzard` (it is used by `npm init`/init-package-json and other tooling).\n- Check whether any code passes attacker-controllable keys as ctx property names to promzard(inputFile, ctx, options). Fixed, hardcoded keys are not exposed.\n- Affected and fixed versions are not published in any source I could read; watch github.com/npm/promzard for a release.","fix":null,"status":"open","published_at":"2026-11-12T16:19:07+00:00","first_seen_at":"2026-11-12T16:44:02+00:00","triaged_at":"2026-11-12T16:45:50+00:00","updated_at":"2026-11-12T16:46:53+00:00","category":"package","confidence":0.5,"triage":{"at":"2026-11-12T16:45:50Z","model":"claude-haiku-5-5","output":{"fix":"unknown","reach":"unknown","title":"promzard: crafted context property names let code run in Node","impact":"high","summary":"promzard is a Node.js library that builds a template function from context property names and evaluates it with vm.runInThisContext(). A crafted property name can escape the parameter list and inject JavaScript that runs with the privileges of the Node.js process.","audience":"developers","category":"package","nicknames":[],"who_cares":["node","npm","promzard"],"confidence":0.6,"fix_status":"unknown","needs_auth":"unknown","worst_case":"Arbitrary code runs with the privileges of the Node.js process","analyst_note":"Find the affected and fixed promzard versions and any patch in the NVD entry at https://nvd.nist.gov/vuln/detail/CVE-2026-127109 or the package registry.","how_to_check":"- Check whether `promzard` appears in your dependency tree, for example with `npm ls promzard`.\n- Check whether any code passes attacker-controllable keys into the ctx object used for promzard templates.","plain_action":"","product_name":"","needs_analyst":true,"not_affected_if":["no-promzard-dependency","fixed-context-keys"],"who_is_affected":"Projects that use promzard to load templates and let outside input control the property names of the context object are exposed. Projects that do not use promzard, or that only pass fixed context keys, are unlikely to be affected. The sources do not list affected or fixed versions.","user_interaction":"unknown","product_ecosystem":"","needs_special_setup":"unknown","severity_if_unknown":"high"},"cost_usd":0.000735,"input_tokens":4590,"output_tokens":551,"severity_before":"unknown"},"analyst_status":"done","analyst_note":"Find the affected and fixed promzard versions and any patch in the NVD entry at https://nvd.nist.gov/vuln/detail/CVE-2026-127109 or the package registry.","search":"'-127109':13A,16A '-2026':12A,15A 'allow':72C 'arbitrari':87C 'attack':74C 'build':27B 'code':7A,62C,88C,132C 'context':3A,32B,82C,99C 'control':77C 'craft':2A,41B,121C 'ctx':84C 'cve':11A,14A 'escap':45B,112C,125C 'evalu':36B,114C 'even':133C 'execut':86C 'file':137C 'fulli':139C 'function':30B,71C,105C 'generat':104C 'inject':50B,63C,130C 'insert':98C 'javascript':51B,131C 'let':6A 'librari':25B,97C 'list':48B,108C,128C 'load':70C 'name':5A,34B,43B,79C,101C,123C 'node':10A,17B 'node.js':24B,59B,94C 'npm':18B 'object':83C 'packag':19B 'paramet':47B,107C,127C 'privileg':56B,91C 'process':60B,95C 'promzard':1A,20B,21B,66C 'properti':4A,33B,42B,78C,100C,122C 'result':116C 'run':8A,53B 'sourc':117C 'templat':29B,69C,136C 'template-load':68C 'trust':140C 'use':118C 'valid':110C 'vm.runinthiscontext':39B,119C 'vulner':64C 'without':109C","nicknames":[],"mitigations":[],"who_affected":"Apps and tools that call promzard and let outside input choose the property names of the ctx object are exposed: injected JavaScript runs with the Node.js process's privileges. Projects that do not use promzard, or pass only fixed ctx keys, can skip it. No affected or fixed versions are published in sources I could read; latest release is 4.0.0 and I found no fix in the repository.","tier":"B","verified":{},"analyst_revisit_at":null,"fix_status":"none","audience":"developers","plain_action":null,"pkeys":[],"ptokens":[],"labels":["high","node","npm","package","promzard"],"campaign_type":null,"search_a":"'-127109':13A,16A '-2026':12A,15A 'code':7A 'context':3A 'craft':2A 'cve':11A,14A 'let':6A 'name':5A 'node':10A 'promzard':1A 'properti':4A 'run':8A","search_b":"'build':27B 'context':32B 'craft':41B 'escap':45B 'evalu':36B 'function':30B 'inject':50B 'javascript':51B 'librari':25B 'list':48B 'name':34B,43B 'node':17B 'node.js':24B,59B 'npm':18B 'packag':19B 'paramet':47B 'privileg':56B 'process':60B 'promzard':20B,21B 'properti':33B,42B 'run':53B 'templat':29B 'vm.runinthiscontext':39B","search_c":"'allow':72C 'arbitrari':87C 'attack':74C 'code':62C,88C,132C 'context':82C,99C 'control':77C 'craft':121C 'ctx':84C 'escap':112C,125C 'evalu':114C 'even':133C 'execut':86C 'file':137C 'fulli':139C 'function':71C,105C 'generat':104C 'inject':63C,130C 'insert':98C 'javascript':131C 'librari':97C 'list':108C,128C 'load':70C 'name':79C,101C,123C 'node.js':94C 'object':83C 'paramet':107C,127C 'privileg':91C 'process':95C 'promzard':66C 'properti':78C,100C,122C 'result':116C 'sourc':117C 'templat':69C,136C 'template-load':68C 'trust':140C 'use':118C 'valid':110C 'vm.runinthiscontext':119C 'vulner':64C 'without':109C","cause_entry":null,"cause_path":null,"disclosures_checked_at":null,"first_public_at":"2026-11-12T16:19:07+00:00","kev":null,"cvss_vector":null,"cvss_by":null,"poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-127109","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-127109","severity":null,"published_at":"2026-11-12T16:19:07+00:00","modified_at":"2026-11-12T16:19:07+00:00","first_seen_at":"2026-11-12T16:44:02+00:00","fetched_at":"2026-11-12T16:44:02+00:00","note":null},{"source":"analyst","external_id":"CVE-2026-127109:3752","url":"https://github.com/npm/promzard/releases","severity":null,"published_at":"2026-11-12T16:46:53+00:00","modified_at":"2026-11-12T16:46:53+00:00","first_seen_at":"2026-11-12T16:46:53+00:00","fetched_at":"2026-11-12T16:46:53+00:00","note":"NVD page returned no text; no maintainer advisory, GHSA, or Snyk entry found. npm/promzard releases show latest v4.0.0 (2026-05-18), commits to 2026-06-18 show no security fix. Affected/fixed versions unknown; nothing verified. Settle by reading the NVD CPE/references or a GHSA once published.","cites":["https://github.com/npm/promzard/releases","https://nvd.nist.gov/vuln/detail/CVE-2026-127109"]}],"documents":[{"id":136567,"url":"https://github.com/npm/promzard/releases","title":"npm/promzard releases (latest v4.0.0, 2026-05-18)","kind":"release","source":"analyst","publisher":null,"text":null,"published_at":null,"relation":"mentions","confidence":null,"note":null},{"id":136568,"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-127109","title":"NVD CVE-2026-127109","kind":"advisory","source":"analyst","publisher":null,"text":null,"published_at":null,"relation":"describes","confidence":null,"note":null}],"disclosures":[],"exploit_sources":[],"notice":"Free to read, with fair use of about 60 pages a minute. For higher limits or API access: sales@infrastack.ai"}