Code Injection Vulnerability in Promzard by npm

CVE-2026-127109

What is CVE-2026-127109?

A code injection vulnerability exists in Promzard's template-loading functionality, which allows an attacker to exploit the context object (ctx). By controlling property names within this object, an attacker can insert arbitrary JavaScript code into the generated function’s parameter list. This is achieved without proper validation or escaping of the property names, which can lead to arbitrary code execution with the privileges of the Node.js process. This vulnerability can be exploited even if the template is considered fully trustworthy, posing a significant risk for applications using this library.

References