{"api_version":"1","generated_at":"2026-11-12T22:49:31+00:00","cve":"CVE-2026-127109","urls":{"html":"https://cve.report/CVE-2026-127109","api":"https://cve.report/api/cve/CVE-2026-127109.json","docs":"https://cve.report/api","cve_org":"https://www.cve.org/CVERecord?id=CVE-2026-127109","nvd":"https://nvd.nist.gov/vuln/detail/CVE-2026-127109"},"summary":{"title":"CVE-2026-127109","description":"A code injection vulnerability in promzard’s template-loading functionality allows an attacker who can control property names in the context object (ctx) to execute arbitrary code with the privileges of the Node.js process. The library inserts context property names into a generated function’s parameter list without validation or escaping and evaluates the resulting source using `vm.runInThisContext()`. A crafted property name can escape the parameter list and inject JavaScript code, even when the template file is fully trusted.","state":"PUBLISHED","assigner":"certcc","published_at":"2026-11-12 16:19:07","updated_at":"2026-11-12 19:22:01"},"problem_types":["CWE-94 Improper Control of Generation of Code ('Code Injection')"],"metrics":[],"references":[{"url":"https://www.kb.cert.org/vuls/id/685399","name":"https://www.kb.cert.org/vuls/id/685399","refsource":"af854a3a-2127-422b-91ae-364da2661108","tags":[],"title":"","mime":"","httpstatus":"","archivestatus":"0"},{"url":"https://github.com/npm/promzard","name":"https://github.com/npm/promzard","refsource":"cret@cert.org","tags":[],"title":"","mime":"","httpstatus":"","archivestatus":"0"},{"url":"https://www.cve.org/CVERecord?id=CVE-2026-127109","name":"CVE Program record","refsource":"CVE.ORG","tags":["canonical"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-127109","name":"NVD vulnerability detail","refsource":"NVD","tags":["canonical","analysis"]}],"affected":[{"source":"CNA","vendor":"Promzard","product":"Promzard","version":"affected 4.0.0 custom","platforms":[]}],"timeline":[],"solutions":[],"workarounds":[],"exploits":[],"credits":[],"nvd_cpes":[],"vendor_comments":[],"enrichments":{"kev":null,"epss":null,"legacy_qids":[]},"source_records":{"cve_program":{"containers":{"adp":[{"providerMetadata":{"dateUpdated":"2026-11-12T17:05:17.829Z","orgId":"af854a3a-2127-422b-91ae-364da2661108","shortName":"CVE"},"references":[{"url":"https://www.kb.cert.org/vuls/id/685399"}],"title":"CVE Program Container"}],"cna":{"affected":[{"product":"Promzard","vendor":"Promzard","versions":[{"lessThanOrEqual":"4.0.0","status":"affected","version":"0","versionType":"custom"}]}],"descriptions":[{"lang":"en","value":"A code injection vulnerability in promzard’s template-loading functionality allows an attacker who can control property names in the context object (ctx) to execute arbitrary code with the privileges of the Node.js process. The library inserts context property names into a generated function’s parameter list without validation or escaping and evaluates the resulting source using `vm.runInThisContext()`. A crafted property name can escape the parameter list and inject JavaScript code, even when the template file is fully trusted."}],"problemTypes":[{"descriptions":[{"description":"CWE-94 Improper Control of Generation of Code ('Code Injection')","lang":"en"}]}],"providerMetadata":{"dateUpdated":"2026-11-12T15:08:53.202Z","orgId":"37e5125f-f79b-445b-8fad-9564f167944b","shortName":"certcc"},"references":[{"url":"https://github.com/npm/promzard"}],"source":{"discovery":"UNKNOWN"},"title":"CVE-2026-127109","x_generator":{"engine":"VINCE 4.0.3","env":"prod","origin":"https://cveawg.mitre.org/api/cve/CVE-2026-127109"}}},"cveMetadata":{"assignerOrgId":"37e5125f-f79b-445b-8fad-9564f167944b","assignerShortName":"certcc","cveId":"CVE-2026-127109","datePublished":"2026-11-12T15:08:53.202Z","dateReserved":"2026-11-12T15:07:38.409Z","dateUpdated":"2026-11-12T17:05:17.829Z","state":"PUBLISHED"},"dataType":"CVE_RECORD","dataVersion":"5.2"},"nvd":{"publishedDate":"2026-11-12 16:19:07","lastModifiedDate":"2026-11-12 19:22:01","problem_types":["CWE-94 Improper Control of Generation of Code ('Code Injection')"],"metrics":[],"configurations":[]},"legacy_mitre":{"record":{"CveYear":"2026","CveId":"127109","Ordinal":"1","Title":"CVE-2026-127109","CVE":"CVE-2026-127109","Year":"2026"},"notes":[{"CveYear":"2026","CveId":"127109","Ordinal":"1","NoteData":"A code injection vulnerability in promzard’s template-loading functionality allows an attacker who can control property names in the context object (ctx) to execute arbitrary code with the privileges of the Node.js process. The library inserts context property names into a generated function’s parameter list without validation or escaping and evaluates the resulting source using `vm.runInThisContext()`. A crafted property name can escape the parameter list and inject JavaScript code, even when the template file is fully trusted.","Type":"Description","Title":"CVE-2026-127109"}]}}}