CVE-2026-127109
Last modified
CVE-2026-127109 is a vulnerability of currently unknown severity. A code injection vulnerability in promzard’s template-loading functionality allows an attacker who can control property names in the context object (ctx) to execute arbitrary code with the privileges of the Node.js process. The library inserts context property names into a generated function’s parameter list without validation or escaping and evaluates the resulting source using `vm.runInThisContext()`.
Description
A code injection vulnerability in promzard’s template-loading functionality allows an attacker who can control property names in the context object (ctx) to execute arbitrary code with the privileges of the Node.js process. The library inserts context property names into a generated function’s parameter list without validation or escaping and evaluates the resulting source using `vm.runInThisContext()`. A crafted property name can escape the parameter list and inject JavaScript code, even when the template file is fully trusted.
Weakness Enumeration
Affected Software
Source: CNA advisory (CVE.org). NVD analysis pending.
| Vendor | Product | Versions |
|---|---|---|
| Promzard | Promzard | <= 4.0.0 |
References
Timeline
- Published
- Last Modified
- Status
- Deferred
Frequently Asked Questions
What is CVE-2026-127109?
How severe is CVE-2026-127109?
How do I fix CVE-2026-127109?
How Strix Helps
- How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
- Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
- PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
- AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.
Related CVEs from 2026
- CVE-2026-127099A flaw was found in SSSD's conversion of X.509 certificate R…5.9
- CVE-2026-1271The ProfileGrid – User Profiles, Groups and Communities plug…5.3
- CVE-2026-12710A Missing Authorization vulnerability in the QueryEngineTask…9.3
- CVE-2026-127100A flaw was found in SSSD's PAM responder on builds with the …5.5
- CVE-2026-127101A flaw was found in SSSD's PAM responder. A local attacker c…5.5
- CVE-2026-127102In Eclipse BaSyx Go Components versions up to and including …7.1
- CVE-2026-127111SOGo before 5.12.13 contains an improper restriction of exce…7.4
- CVE-2026-127119Unverified ownership of the default cluster log location in …5.3
- CVE-2026-127120A vulnerability was found in Governikus AusweisApp Mobile up…4.3
- CVE-2026-127121SOGo before 5.12.13 contains an improper cryptographic signa…6.5
- CVE-2026-127122P-Net before 1.0.4 does not check the number of MCR request …7.2
- CVE-2026-127123P-Net before 1.0.4 releases the Application Relationship of …6
Are you affected by CVE-2026-127109?
Run a free Strix scan to check your systems for this vulnerability.
Scan your code nowSource: NVD / NIST