CVE record · 2 sources
CVE-2026-127109
A code injection vulnerability in promzard’s template-loading functionality allows an attacker who can control property names in the context object…
- Vendor
- Promzard
- Product
- Promzard
- Exposure class
- Developer platform
Coverage
2Every item in the archive that references this CVE, highest rank first. Headlines open the publisher.
-
PromZard context key code injection leads to remote code execution
Overview The npm library promzard , versions 4.0.0 and earlier, is vulnerable to remote code execution due to direct string interpolation of context object keys, which allows unsanitized JavaScript code injection. Description…
-
A code injection vulnerability in promzard’s template-loading functionality allows an attacker who can control property names in the context object…
A code injection vulnerability in promzard’s template-loading functionality allows an attacker who can control property names in the context object (ctx) to execute arbitrary code with the privileges of the Node.js process. The…