CVE-2026-127109: Code Injection
A code injection vulnerability in promzard’s template-loading functionality allows an attacker who can control property names in the context object (ctx) to execute arbitrary code with the privileges of the Node.js process. The library inserts context property names into a generated function’s parameter list without validation or escaping and evaluates the resulting source using vm.runInThisContext(). A crafted property name can escape the parameter list and inject JavaScript code, even when the template file is fully trusted.
Event History
Frequently Asked Questions
What access does an attacker need to exploit this issue?
The attacker must be able to control property names in the context object passed to promzard's template-loading functionality. Control of the template file itself is not required.
What is the impact of successful exploitation?
A crafted context property name can inject JavaScript into generated source code. The injected code executes with the privileges of the Node.js process.
Are trusted template files sufficient to prevent exploitation?
No. The issue can be exploited even when the template file is fully trusted, because the injection occurs through unvalidated context property names.