{"vuid":"VU#685399","idnumber":"685399","name":"PromZard context key code injection leads to remote code execution","keywords":null,"overview":"### Overview\r\nThe npm library `promzard`, versions 4.0.0 and earlier, is vulnerable to remote code execution due to direct string interpolation of context object keys, which allows unsanitized JavaScript code injection. \r\n\r\n### Description\r\n`promzard` is a `Node.js` library designed to automate configuration workflows by evaluating template modules and generating data objects via interactive prompting. The library allows users to provide a context object `ctx` to expose specific data to the template module. \r\n\r\n`promzard` builds an object by walking the template module for `prompt()` and asynchronous functions. The keys of `ctx`, however, are treated as raw JavaScript source code instead of inert data. The implementation performs direct string interpolation of `ctx` keys, without validation or sanitization, into the parameter list of a function-expression source string that is then evaluated with `vm.runInThisContext()`. A key containing attacker-controlled JavaScript syntax can be executed during evaluation. \r\n\r\n### Impact\r\nAn attacker capable of influencing the `ctx` object’s keys (e.g. via parsed configuration file, an HTTP request, or environment variables) can break out of the function parameter list and inject arbitrary JavaScript code. This results in remote code execution within the context of the Node.js process.\r\n\r\n### Solution\r\nUnfortunately, the maintainers of `promzard` could not be reached to coordinate the vulnerability. The CERT/CC recommends users ensure that any data used to populate `ctx` is strictly validated, and that arbitrary keys should not be passed from untrusted sources.\r\n\r\n### Acknowledgements\r\nThanks to Abdullah Hamdan for reporting this vulnerability. This document was written by Alex Lewis.","clean_desc":null,"impact":null,"resolution":null,"workarounds":null,"sysaffected":null,"thanks":null,"author":null,"public":[],"cveids":["CVE-2026-127109"],"certadvisory":null,"uscerttechnicalalert":null,"datecreated":"2026-11-12T15:09:39.346388Z","publicdate":"2026-11-12T15:09:39.215425Z","datefirstpublished":"2026-11-12T15:09:39.357404Z","dateupdated":"2026-11-12T15:09:39.215421Z","revision":1,"vrda_d1_directreport":null,"vrda_d1_population":null,"vrda_d1_impact":null,"cam_widelyknown":null,"cam_exploitation":null,"cam_internetinfrastructure":null,"cam_population":null,"cam_impact":null,"cam_easeofexploitation":null,"cam_attackeraccessrequired":null,"cam_scorecurrent":null,"cam_scorecurrentwidelyknown":null,"cam_scorecurrentwidelyknownexploited":null,"ipprotocol":null,"cvss_accessvector":null,"cvss_accesscomplexity":null,"cvss_authentication":null,"cvss_confidentialityimpact":null,"cvss_integrityimpact":null,"cvss_availabilityimpact":null,"cvss_exploitablity":null,"cvss_remediationlevel":null,"cvss_reportconfidence":null,"cvss_collateraldamagepotential":null,"cvss_targetdistribution":null,"cvss_securityrequirementscr":null,"cvss_securityrequirementsir":null,"cvss_securityrequirementsar":null,"cvss_basescore":null,"cvss_basevector":null,"cvss_temporalscore":null,"cvss_environmentalscore":null,"cvss_environmentalvector":null,"metric":null,"vulnote":274}