{"document":{"acknowledgments":[{"urls":["https://kb.cert.org/vuls/id/685399#acknowledgements"]}],"category":"CERT/CC Vulnerability Note","csaf_version":"2.0","notes":[{"category":"summary","text":"### Overview\r\nThe npm library `promzard`, versions 4.0.0 and earlier, is vulnerable to remote code execution due to direct string interpolation of context object keys, which allows unsanitized JavaScript code injection. \r\n\r\n### Description\r\n`promzard` is a `Node.js` library designed to automate configuration workflows by evaluating template modules and generating data objects via interactive prompting. The library allows users to provide a context object `ctx` to expose specific data to the template module. \r\n\r\n`promzard` builds an object by walking the template module for `prompt()` and asynchronous functions. The keys of `ctx`, however, are treated as raw JavaScript source code instead of inert data. The implementation performs direct string interpolation of `ctx` keys, without validation or sanitization, into the parameter list of a function-expression source string that is then evaluated with `vm.runInThisContext()`. A key containing attacker-controlled JavaScript syntax can be executed during evaluation. \r\n\r\n### Impact\r\nAn attacker capable of influencing the `ctx` object’s keys (e.g. via parsed configuration file, an HTTP request, or environment variables) can break out of the function parameter list and inject arbitrary JavaScript code. This results in remote code execution within the context of the Node.js process.\r\n\r\n### Solution\r\nUnfortunately, the maintainers of `promzard` could not be reached to coordinate the vulnerability. The CERT/CC recommends users ensure that any data used to populate `ctx` is strictly validated, and that arbitrary keys should not be passed from untrusted sources.\r\n\r\n### Acknowledgements\r\nThanks to Abdullah Hamdan for reporting this vulnerability. This document was written by Alex Lewis.","title":"Summary"},{"category":"legal_disclaimer","text":"THIS DOCUMENT IS PROVIDED ON AN 'AS IS' BASIS AND DOES NOT IMPLY ANY KIND OF GUARANTEE OR WARRANTY, INCLUDING THE WARRANTIES OF MERCHANTABILITY OR FITNESS FOR A PARTICULAR USE. YOUR USE OF THE INFORMATION ON THE DOCUMENT OR MATERIALS LINKED FROM THE DOCUMENT IS AT YOUR OWN RISK. ","title":"Legal Disclaimer"},{"category":"other","text":"CERT/CC Vulnerability Note is a limited advisory. It primarily identifies vendors impacted by the advisory and not specific products. We only support \"known_affected\" and \"known_not_affected\" status. Please consult the vendor's statements and advisory URL if provided by the vendor for more details ","title":"Limitations of Advisory"}],"publisher":{"category":"coordinator","contact_details":"Email: cert@cert.org, Phone: +1412 268 5800","issuing_authority":"CERT/CC under DHS/CISA https://www.cisa.gov/cybersecurity also see https://kb.cert.org/ ","name":"CERT/CC","namespace":"https://kb.cert.org/"},"references":[{"url":"https://certcc.github.io/certcc_disclosure_policy","summary":"CERT/CC vulnerability disclosure policy"},{"summary":"CERT/CC document released","category":"self","url":"https://kb.cert.org/vuls/id/685399"}],"title":"PromZard context key code injection leads to remote code execution","tracking":{"current_release_date":"2026-11-12T15:09:39+00:00","generator":{"engine":{"name":"VINCE","version":"4.0.3"}},"id":"VU#685399","initial_release_date":"2026-11-12 15:09:39.215425+00:00","revision_history":[{"date":"2026-11-12T15:09:39+00:00","number":"1.20261112150939.1","summary":"Released on 2026-11-12T15:09:39+00:00"}],"status":"final","version":"1.20261112150939.1"}},"vulnerabilities":[{"title":"A code injection vulnerability in promzard’s template-loading functionality allows an attacker who can control property names in the context object (ctx) to execute arbitrary code with the privileges of the Node.","notes":[{"category":"summary","text":"A code injection vulnerability in promzard’s template-loading functionality allows an attacker who can control property names in the context object (ctx) to execute arbitrary code with the privileges of the Node.js process. The library inserts context property names into a generated function’s parameter list without validation or escaping and evaluates the resulting source using `vm.runInThisContext()`. A crafted property name can escape the parameter list and inject JavaScript code, even when the template file is fully trusted."}],"cve":"CVE-2026-127109","ids":[{"system_name":"CERT/CC V Identifier ","text":"VU#685399"}]}],"product_tree":{"branches":[]}}