PromZard CVE-2026-127109: JavaScript Code Injection via Context Key Source Embedding

1. Basic Information

• Article Name: PromZard context key code injection leads to remote code execution
• Publisher: CERT/CC
• Publication Date: 2026-11-12
• Updated Date: 2026-11-12
• Collection Date: 2026-11-14T08:00:43+09:00
• Original Source: CERT/CC
• Related Information Sources: JVN: promzard code injection
• Related Malware: None
• Related Threat Groups: None
• Related CVE: CVE-2026-127109
• Related Products and Technologies: promzard <= 4.0.0, Node.js
• Response Priority (Author Assessment): High
• Basis for Response Priority: In implementations where untrusted input from settings, HTTP requests, or environment variables enters context keys, this leads to remote code execution with Node.js process privileges, and coordination with maintainers and an official fix have not been confirmed. This is the author's response priority, not a vendor severity rating or CVSS score.

2. Executive Summary

CERT/CC has reported a vulnerability in promzard version 4.0.0 and earlier where the context object key is embedded directly into the function parameter source and evaluated using vm.runInThisContext(), allowing attackers who can control the key to execute arbitrary JavaScript within the Node.js process.

3. Attack Flow

Code Execution from Context Key

1. An attacker supplies a crafted object key via configuration settings, requests, or other inputs.
2. The application passes that object to the promzard context.
3. Promzard interpolates the key into the function parameter source.
4. The vm.runInThisContext() function evaluates the crafted source, executing arbitrary JavaScript.

4. Attacker Position and Execution Location

• A remote or local input actor who can indirectly or directly control context keys.

5. Visibility for Victims and Administrators

Victim Side

• May appear as configuration processing failures or abnormal service behavior.

Administrator Side

• Inference: May appear as unexpected code paths, child processes, or file/network access within the Node.js process (when process telemetry, EDR, or similar records are available). However, code execution that does not involve child processes or outbound network traffic may leave no such traces.

6. Success and Failure Conditions

Success Conditions

• Using promzard 4.0.0 or earlier.
• The attacker being able to influence context keys.
• Reaching the code path where the generated source is executed.

Failure Conditions and Mitigations

• Remove promzard or replace it with a fixed version.
• Validate context keys using a fixed allow-list and identifier pattern.

Note that privilege reduction and outbound traffic restrictions are measures to limit post-execution damage and do not prevent code execution itself.

7. Impact of Successful Exploitation

• Arbitrary code execution with Node.js process privileges.
• Access to credentials, files, and network resources.

8. Observable Logs

• email: None specified
• Proxy / SWG / DNS: Inference: Requests containing abnormal object keys (when the request body is available for inspection, for example through decryption and recording) or configuration inputs (when confirmed via application input logs and configuration history).
• Endpoint / EDR: Inference: Unexpected child processes or file writes originating from Node.js (when recorded in EDR or process telemetry). However, code execution without child processes or outbound traffic may leave no traces.
• Identity / IdP: None specified
• SaaS / Cloud: None specified
• network: Inference: Unknown egress traffic originating from the service (when network telemetry records exist).

9. Attack Success Assessment

Confirmed Scope in Public Information

• Public Information: CERT/CC describes the execution of arbitrary JavaScript when context keys can be controlled. Public sources do not establish who successfully reproduced the issue, in what environment, or with what results, nor do they confirm exploitation in the wild.
• Confirmed Scope: Public sources only confirm the explanation of arbitrary JavaScript execution when context keys can be controlled.

10. Investigation Playbook

• trigger: Unexpected commands, crafted keys, or runtime exceptions in the Node.js process.
• Initial Checks: Verify dependency versions, context generation sources, input pathways, and process privileges.
• endpoint: Preserve process trees, memory, configurations, and package lock files.
• Identity / Cloud: Check access to service accounts, tokens, and cloud credentials.
• Follow-on Activity: Expand checks to other services and build pipelines using the same dependencies.
• containment: Isolate services, replace dependencies, rotate credentials, and perform clean deployments.
• classification: Distinguish between vulnerable dependencies only, input reachability, code execution, and credential access.

11. Defense and Detection Ideas

• Single-Event Detection: Shell commands, curl, or PowerShell originating from Node.js.
• Time-Series Correlation: Correlate crafted configurations or requests leading to exceptions or child processes followed by egress traffic.
• hunting: Search SBOMs or lock files for promzard <=4.0.0 and context key input pathways.
• Logging Gaps: If application-level key logging is absent, integrate WAF/configuration history with process telemetry.
• Priority Controls: Prioritize dependency removal, key allow-lists, and the principle of least privilege. Privilege reduction and outbound traffic restrictions serve to limit post-execution damage.

12. Facts / Inference / Hypothesis

Facts

• Promzard directly embeds context keys into the formal parameter list of the generated function expression.
• The generated source is evaluated using vm.runInThisContext().
• If an attacker can control context keys, they can execute arbitrary JavaScript with Node.js process privileges using crafted keys.
• CERT/CC was unable to reach the maintainers to coordinate a fix, and no coordinated fix had been confirmed as of publication.
• It is recommended to use allow-lists and identifier validation for keys as well as values, and to avoid passing untrusted objects to the context.

Inference

• Even higher-level tools that do not directly utilize promzard can be affected if they transparently pass configuration object keys.

Hypothesis

• No additional hypotheses

13. MITRE ATT&CK Mapping

No specific MITRE ATT&CK techniques have been mapped in this report.

14. Unknowns and Additional Investigation

• Formal responses from all dependent projects and maintainers, as well as the presence of real-world exploitation, remain unconfirmed.

15. Impact on SOCs and Organizations

Search direct and transitive dependencies in Node.js projects and restrict context keys passed to promzard using a fixed allow-list.

16. Summary by Role

• For SOCs: Monitor Node.js processes for unexpected child processes, network egress, and abnormal keys originating from configurations.
• For Administrators: Remove or fork-patch promzard, restricting context keys to an allow-list of valid JavaScript identifiers.
• For Users: This issue resides in development and server-side dependencies; direct actions by end users are typically unnecessary.