VORANT. Threat Intelligence Research Create a free account

RCE flaw found in npm library promzard

Published Vorant ratingroutine vulnerability Technology

Vorant's rating weighs the evidence in the report: confirmed exploitation, victims claimed, CVSS and EPSS, and how many sources agree. It rates the report, not your assets.

The promzard npm library (v4.0.0 and earlier) allows remote code execution via unsanitized JavaScript injection in context object keys, with no maintainer fix available.

Sourcekb.cert.org — open the original

What to check

Applies to
The 1 CVE named below. Whether you run an affected version is not assessed: check the versions the source lists.
Exploitation
No exploitation in the wild and no public exploit is recorded for the CVEs named.

CERT/CC has published a vulnerability note for promzard, a Node.js library used to automate configuration workflows via template modules and interactive prompting. The library builds a data object using a context object (ctx) whose keys are directly interpolated as raw JavaScript source code into a function-expression string that is then evaluated with vm.runInThisContext(), without any validation or sanitization. This design flaw means any attacker who can influence the keys of the ctx object—through a parsed configuration file, an HTTP request, or environment variables—can break out of the function parameter list and inject arbitrary JavaScript, achieving remote code execution within the Node.js process.

The vulnerability has been assigned CVE-2026-127109. No patch or coordinated fix is currently available because CERT/CC was unable to reach the promzard maintainers. There is no indication in the advisory that this flaw is being exploited in the wild; it was reported by researcher Abdullah Hamdan. CERT/CC's sole guidance is for developers to strictly validate any data used to populate the ctx object and to avoid passing arbitrary or untrusted keys into it, since no official remediation exists.

Defenders and developers using promzard (versions 4.0.0 and earlier) in Node.js projects should treat any application that feeds external or user-controlled data into the library's context object as vulnerable to code execution, and should either restrict ctx inputs to trusted, validated sources or consider removing/replacing the dependency given the lack of maintainer response.

Mentioned in this report

Vulnerabilities CVE-2026-127109

Detection guidance

Node.js Process Spawning Recon or Download Tooling

ATT&CK T1059.007 · status experimental · needs windows process_creation logs · generated from the report, not run against telemetry

A behavioural hunt for the technique in general, not a signature for the CVEs this report names.

node.exe spawning reconnaissance or LOLBin download utilities or PowerShell/cmd download cradles, consistent with post-exploitation after JavaScript injection into a Node.js process such as the promzard ctx flaw. Auto-generated starting point — validate and tune in your environment before deploying. IOC matches can false-positive on shared infrastructure and decay as adversary infrastructure rotates.

title: Node.js Process Spawning Recon or Download Tooling
description: Detects node.exe spawning discovery utilities, LOLBin downloaders or
  PowerShell/cmd download and encoded-command cradles. Generic post-exploitation pattern
  after arbitrary JavaScript injection into a Node.js process (for example the promzard
  ctx key injection, CVE-2026-127109). No in-the-wild exploitation is reported, so
  this is a behavioural hunt for the outcome, not the exploit itself.
tags:
- attack.execution
- attack.t1059.007
- attack.t1190
logsource:
  category: process_creation
  product: windows
detection:
  selection_parent:
    ParentImage|endswith: \node.exe
  selection_tools:
    Image|endswith:
    - \whoami.exe
    - \nltest.exe
    - \certutil.exe
    - \bitsadmin.exe
    - \mshta.exe
    - \net.exe
    - \net1.exe
  selection_shell_cradle:
    Image|endswith:
    - \cmd.exe
    - \powershell.exe
    - \pwsh.exe
    CommandLine|contains:
    - DownloadString
    - DownloadFile
    - Invoke-Expression
    - FromBase64String
    - -EncodedCommand
    - ' -enc '
    - certutil
    - bitsadmin
  condition: selection_parent and (selection_tools or selection_shell_cradle)
falsepositives:
- Developer build or setup scripts run through npm that call certutil or net.exe
- Node-based admin or deployment tooling that runs whoami for environment checks
level: medium
id: 27e06ff0-1d6f-57e7-8c39-8d6ec77b2d9a
status: experimental
author: Vorant
references:
- https://kb.cert.org/vuls/id/685399

Node.js Spawning Shell With Reverse Shell or Pipe-to-Shell Pattern

ATT&CK T1059.004 · status experimental · needs linux process_creation logs · generated from the report, not run against telemetry

A behavioural hunt for the technique in general, not a signature for the CVEs this report names.

A node process spawning sh/bash with download-and-pipe-to-shell or reverse shell command lines, typical of RCE payloads in Node.js applications. Auto-generated starting point — validate and tune in your environment before deploying. IOC matches can false-positive on shared infrastructure and decay as adversary infrastructure rotates.

title: Node.js Spawning Shell With Reverse Shell or Pipe-to-Shell Pattern
description: Detects a node process launching sh/bash with reverse shell or curl/wget
  piped to a shell command lines. Typical payload after JavaScript code injection
  into a Node.js application, such as via promzard ctx keys (CVE-2026-127109).
tags:
- attack.execution
- attack.t1059.004
- attack.t1190
logsource:
  category: process_creation
  product: linux
detection:
  selection_parent:
    ParentImage|endswith:
    - /node
    - /nodejs
  selection_shell:
    Image|endswith:
    - /sh
    - /bash
    - /dash
  selection_cmd:
    CommandLine|contains:
    - /dev/tcp/
    - bash -i
    - mkfifo
    - nc -e
    - '| sh'
    - '|sh'
    - '| bash'
    - '|bash'
  condition: selection_parent and selection_shell and selection_cmd
falsepositives:
- Node-based installers that pipe a downloaded script into sh as part of provisioning
- Developer tooling run via npm scripts that uses mkfifo for IPC
level: high
id: df074148-fc90-53df-93eb-7ef1886670d7
status: experimental
author: Vorant
references:
- https://kb.cert.org/vuls/id/685399

Behavioural rules are generated from public reporting — validate in your environment before deploying.

Source reporting: https://kb.cert.org/vuls/id/685399

Free public brief. The detections with Splunk SPL already written (plus Elastic and KQL where they apply) are in the app with a free account, no card. Slack alerts on the vendors you run come with the paid plans, and a new account gets three days of them.

What this brief leaves out

This page is the free tier: the write-up, the severity, the names. In the app the same report carries its detections (Splunk SPL already written, plus Elastic and Microsoft KQL where they apply) and live profiles of the CVEs it names. The paid plans add the security research and news reporting the free tier leaves out.

It sits in a corpus of 16,436 reports from 149 sources, 661 of them written in the last seven days, and it grows through the day.

A new account starts with three days of all of it, no card, then keeps the government and CERT reporting free. Slack alerts are a paid-plan feature: name the vendors you run and Slack hears about the reports that touch them, not the rest of the week's. Nothing is charged unless you subscribe.

Create a free account   What it costs