EUVD-2026-44939
GHSA-c4gh-rv8h-q9vw
Severity by source
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
Unauthenticated code execution (PR:N) via a delivered file that a user/process must load (UI:R), low complexity, full C/I/A impact within the host process (scope unchanged).
Primary rating from Vendor (GitHub_M).
CVSS VectorVendor: GitHub_M
Lifecycle Timeline
4DescriptionCVE.org
Prompty is a markdown file format (.prompty) for LLM prompts. From 2.0.0-alpha.1 until 2.0.0-beta.3, the @prompty/core TypeScript loader in runtime/typescript/packages/core/src/core/loader.ts used gray-matter without overriding executable js and javascript frontmatter engines, allowing an attacker-controlled .prompty file with ---js frontmatter to execute arbitrary JavaScript during prompt loading. This issue is fixed in version 2.0.0-beta.3.
AnalysisAI
Arbitrary JavaScript execution in Microsoft's @prompty/core TypeScript loader (2.0.0-alpha.1 through 2.0.0-beta.2) allows an attacker who supplies a crafted .prompty file to run code during prompt loading. The loader passed .prompty markdown to gray-matter without disabling its executable 'js'/'javascript' frontmatter engines, so a '---js' frontmatter block is evaluated as Node.js at parse time. Exploitation requires the victim's application to load the malicious file (UI:P); no public exploit is identified at time of analysis and it is not on CISA KEV, but the fix commit ships a working proof-of-concept test.
Technical ContextAI
Prompty defines a markdown-based (.prompty) file format for LLM prompts, with YAML-style frontmatter carrying model/config metadata. The TypeScript runtime's core loader (runtime/typescript/packages/core/src/core/loader.ts) parses this frontmatter with the popular gray-matter library. gray-matter supports pluggable 'engines' and, when the frontmatter language is declared as 'js' or 'javascript' (via a '---js' fence), it evaluates that block as live JavaScript rather than treating it as inert data. The loader called matter(raw) without overriding those engines, so untrusted content reaches an interpreter. This is a textbook CWE-94 (Improper Control of Generation of Code / code injection): data crossing a trust boundary is executed instead of parsed. The fix registers custom js/javascript engines whose parse function throws, so executable frontmatter is rejected rather than run.
RemediationAI
Vendor-released patch: upgrade @prompty/core (and dependent @prompty/* packages) to 2.0.0-beta.3 or later, which registers hardened js/javascript gray-matter engines that throw instead of evaluating executable frontmatter. Follow the advisory at https://github.com/microsoft/prompty/security/advisories/GHSA-c4gh-rv8h-q9vw and the fix at https://github.com/microsoft/prompty/commit/c27402da2487075be577f06aa79df627fb9d6853. If you cannot upgrade immediately, do not load .prompty files from untrusted or user-controlled sources, and pre-screen any incoming .prompty files to reject those containing a '---js' or '---javascript' frontmatter fence before passing them to the loader; the trade-off is that this manual gate is easy to bypass with encoding tricks and does not cover other gray-matter engine abuses, so it is a stopgap only. Restricting the prompt-loading process's privileges and filesystem/network access (least privilege sandboxing) limits blast radius but does not close the injection.
Server-side template injection leading to remote code execution in Microsoft's @prompty/core npm package (TypeScript run
Arbitrary file read in Microsoft Prompty's multi-ecosystem runtime libraries (PyPI, npm, Rust, NuGet) exposes any file r
Same weakness CWE-94 – Code Injection
View allShare
External POC / Exploit Code
Leaving vuln.today