CVE-2026-127109

A code injection vulnerability in promzard’s template-loading functionality allows an attacker who can control property names in the context object ctx to execute arbitrary code with the privileges of the Node.js process. The library inserts context property names into a generated function’s...

CVE-2026-127109 CVE-2026-127109

A code injection vulnerability in promzard’s template-loading functionality allows an attacker who can control property names in the context object ctx to execute arbitrary code with the privileges of the Node.js process. The library inserts context property names into a generated function’s...

CVE-2026-127109

A code injection vulnerability exists in the template-loading functionality of the promzard library. The flaw occurs because the library inserts context object property names into a generated function's parameter list without proper validation or escaping. This allows an attacker who can control ...