Overview The npm library promzard , versions 4.0.0 and earlier, is vulnerable to remote code execution due to direct string interpolation of context object keys, which allows unsanitized JavaScript code injection. Description promzard is a Node.js library designed to automate configuration workflows by evaluating template modules and generating data objects via interactive prompting. The library allows users to provide a context object ctx to expose specific data to the template module. promzard builds an object by walking the template module for prompt() and asynchronous functions. The keys of ctx , however, are treated as raw JavaScript source code instead of inert data. The implementation