---
id: "CVE-2026-127109"
page: "https://infrastack.ai/live/CVE-2026-127109"
kind: "vulnerability"
aliases: ["CVE-2026-127109"]
title: "promzard: crafted context property names let code run in Node"
severity: "high"
cvss: null
epss: null
exploited: false
status: "open"
category: "package"
products: []
ecosystems: []
tags: ["node", "npm", "package", "promzard"]
not_affected_if: ["fixed-context-keys", "no-promzard-dependency"]
published_at: "2026-11-12T16:19:07+00:00"
first_seen_at: "2026-11-12T16:44:02+00:00"
updated_at: "2026-11-12T16:46:53+00:00"
sources: [{"source": "nvd", "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-127109", "first_seen_at": "2026-11-12T16:44:02+00:00"}, {"source": "analyst", "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-127109", "first_seen_at": "2026-11-12T16:46:53+00:00", "cites": ["https://nvd.nist.gov/vuln/detail/CVE-2026-127109", "https://github.com/npm/promzard/releases"]}]
exploit_sources: []
---

# promzard: crafted context property names let code run in Node

Link for people: https://infrastack.ai/live/CVE-2026-127109 (this .md is for agents)

promzard is a Node.js library that builds a template function from context property names and evaluates it with vm.runInThisContext(). A crafted property name can escape the parameter list and inject JavaScript that runs with the privileges of the Node.js process.

_Summary, check and fix written by a model from the sources; labelled as such._

## How to check

- Run `npm ls promzard` (it is used by `npm init`/init-package-json and other tooling).
- Check whether any code passes attacker-controllable keys as ctx property names to promzard(inputFile, ctx, options). Fixed, hardcoded keys are not exposed.
- Affected and fixed versions are not published in any source I could read; watch github.com/npm/promzard for a release.

## Timeline

- 2026-11-12T16:44:02+00:00 nvd https://nvd.nist.gov/vuln/detail/CVE-2026-127109
- 2026-11-12T16:46:53+00:00 analyst https://nvd.nist.gov/vuln/detail/CVE-2026-127109 — NVD page returned no text; no maintainer advisory, GHSA, or Snyk entry found. npm/promzard releases show latest v4.0.0 (2026-05-18), commits to 2026-06-18 show no security fix. Affected/fixed versions unknown; nothing verified. Settle by reading the NVD CPE/references or a GHSA once published.

## Documents

- [describes] NVD CVE-2026-127109 https://nvd.nist.gov/vuln/detail/CVE-2026-127109
- [mentions] npm/promzard releases (latest v4.0.0, 2026-05-18) https://github.com/npm/promzard/releases

## From the sources

A code injection vulnerability in promzard’s template-loading functionality allows an attacker who can control property names in the context object (ctx) to execute arbitrary code with the privileges of the Node.js process. The library inserts context property names into a generated function’s parameter list without validation or escaping and evaluates the resulting source using `vm.runInThisContext()`. A crafted property name can escape the parameter list and inject JavaScript code, even when the template file is fully trusted.

---

_Free to read, with fair use of about 60 pages a minute. For higher limits or API access: sales@infrastack.ai_