Prompts Chat CVE-2026-22661

Requires prompts.chat prior to commit 0f8d4c3. Attacker creates malicious ZIP archive with path traversal sequences (../) in skill filenames. Victim must download and extract the archive. Remote unauthenticated attacker; victim interaction required.

Real-world risk is substantial despite requiring user interaction. The CVSS 8.6 score reflects high confidentiality and integrity impact (VC:H, VI:H) with network accessibility and no authentication barriers-attackers need only induce users to import malicious skill files. The UI:P requirement (user must trigger import/extraction) provides minimal protection as users routinely import skill files as core platform functionality. Attack complexity is low (AC:L) since ZIP path traversal exploitation requires no cryptographic breaks or race conditions, just crafted filenames. The technical impact enables arbitrary file writes culminating in code execution through shell initialization file overwrites, satisfying critical impact thresholds. Without EPSS data or SSVC exploitation status, we cannot quantify likelihood, but the combination of network reachability, pre-authentication attack surface, and code execution potential warrants high prioritization. No CISA KEV listing indicates no confirmed active exploitation campaigns. The availability of proof-of-concept details in the VulnCheck advisory and referenced GitHub PR increases exploitation probability. Organizations using prompts.chat for collaborative prompt engineering face immediate risk if users import skill files from untrusted sources. The automatable potential is moderate-while payload crafting is trivial, successful exploitation requires social engineering to distribute malicious archives.

An attacker creates a malicious skill file packaged as a ZIP archive containing a crafted filename like '../../../../home/victim/.bashrc' pointing to a payload script that establishes reverse shell connections. The attacker distributes this archive through social engineering (phishing, forum posts, or compromised repositories) targeting prompts.chat users seeking new AI prompt templates. When the victim imports the skill file through the prompts.chat interface, the vulnerable extraction routine processes the archive without sanitizing the path traversal sequence, writing the malicious payload to the user's bash initialization file instead of the intended skill directory. Upon the victim's next terminal session, the overwritten .bashrc executes automatically, granting the attacker code execution with the victim's privileges and establishing persistent access.