Promzard context key code injection enables remote code execution

The npm library promzard, in versions 4.0.0 and earlier, contains a code injection weakness in how it handles context object keys, which permits remote code execution within a Node.js process.

Promzard is a Node.js library that automates configuration workflows by evaluating template modules and building data objects through interactive prompting. Callers may pass a context object, ctx, to expose selected data to the template module. The library walks the template module to locate prompt() calls and asynchronous functions. Keys within ctx are not treated as inert data. They are inserted directly, with no validation or sanitization, into the parameter list of a function-expression source string, which is then evaluated with vm.runInThisContext().

A key containing attacker-supplied JavaScript syntax can run during that evaluation. The vulnerability is tracked as CVE-2026-127109. One or more vendors are listed for this vulnerability, and the full report contains further detail.

Anyone able to influence the keys of ctx, for example through a parsed configuration file, an HTTP request, or environment variables, can end the function parameter list early and insert arbitrary JavaScript. Execution then occurs within the context of the Node.js process, which results in remote code execution.

The maintainers of promzard could not be reached to coordinate the vulnerability, and no fix is referenced in this record. CERT/CC recommends that any data used to populate ctx be strictly validated and that arbitrary keys not be passed from untrusted sources.

Abdullah Hamdan reported the vulnerability. Alex Lewis wrote the document. It was made public and first published on 2026-11-12, last updated 2026-11-12 at 15:09 UTC, and is at document revision 1.