EUVD-2026-44940
GHSA-wxhm-2mq7-7697
Severity by source
AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
AV:N appropriate as prompty files can be delivered remotely, but AC:H reflects that exploitation requires both attacker-controlled file loading and content exposure to the attacker - deployment-dependent conditions not universally met.
Primary rating from Vendor (GitHub_M).
CVSS VectorVendor: GitHub_M
Lifecycle Timeline
4DescriptionCVE.org
Prompty is a markdown file format (.prompty) for LLM prompts. Prior to 2.0.0-beta.2, Prompty loaders expanded ${file:...} references in .prompty frontmatter without enforcing that resolved paths stayed within the prompt directory or allowed roots, allowing an attacker-controlled prompt file to read local files through absolute paths, .. traversal, or symlink escapes. This issue is fixed in versions 2.0.0-beta.2.
AnalysisAI
Arbitrary file read in Microsoft Prompty's multi-ecosystem runtime libraries (PyPI, npm, Rust, NuGet) exposes any file readable by the host process when an attacker can supply a crafted .prompty file. The ${file:...} reference expansion in .prompty frontmatter performed no path canonicalization or boundary enforcement, allowing absolute paths, .. traversal sequences, and symlink escapes to resolve outside the prompt directory. No public exploit has been identified at time of analysis, but the SSVC framework rates the technique automatable, making this a meaningful risk for any application that loads user-supplied or externally-sourced prompty files.
Technical ContextAI
Prompty is a cross-ecosystem SDK for defining LLM prompts in YAML-frontmatter markdown files (.prompty), maintained by Microsoft at github.com/microsoft/prompty. Runtimes ship for Python (PyPI prompty), JavaScript/TypeScript (npm @prompty/core), Rust (crates.io prompty), and .NET (NuGet Prompty.Core). The ${file:path} interpolation syntax embeds external file content into prompt frontmatter fields at load time. The vulnerability (CWE-22: Improper Limitation of a Pathname to a Restricted Directory) arises because the loader resolved paths relative to the prompt directory but neither canonicalized the result nor validated it against any allowed-root prefix before performing the filesystem read. This allowed callers to specify absolute paths such as ${file:/etc/shadow}, traversal sequences such as ${file:../../../secret.txt}, or symlinks pointing outside the prompt tree. The fix in commit 88ac9948d7d37995edbb2f6d36913436626c39e1 canonicalizes all file-reference targets and allowed roots, rejects targets outside the prompt file's directory by default, and introduces a new AllowedFileRoots option in PromptyLoadOptions for applications that legitimately require access to shared prompt assets in other directories.
RemediationAI
Upgrade to the patched version for your ecosystem: PyPI prompty 2.0.0b2, npm @prompty/core 2.0.0-beta.2, crates.io prompty 2.0.0-beta.2, or NuGet Prompty.Core 2.0.0-beta.2 - all delivered in commit 88ac9948d7d37995edbb2f6d36913436626c39e1. The full advisory is at https://github.com/microsoft/prompty/security/advisories/GHSA-wxhm-2mq7-7697. Prior to patching, restrict the application to loading .prompty files only from trusted, internally-controlled directories; never accept prompt file paths or bundles derived from user input. If the application needs to access shared prompt assets outside the prompt directory after upgrading, use the new AllowedFileRoots option in PromptyLoadOptions (C
example shown in commit diff) - treat this option as a privileged configuration value and never populate it from user-supplied data, as doing so would reintroduce the vulnerability.
Server-side template injection leading to remote code execution in Microsoft's @prompty/core npm package (TypeScript run
Arbitrary JavaScript execution in Microsoft's @prompty/core TypeScript loader (2.0.0-alpha.1 through 2.0.0-beta.2) allow
Same weakness CWE-22 – Path Traversal
View allSame technique Path Traversal
View allShare
External POC / Exploit Code
Leaving vuln.today