Prompty
Monthly
Server-side template injection leading to remote code execution in Microsoft's @prompty/core npm package (TypeScript runtime) allows an attacker who controls a .prompty template body to execute arbitrary JavaScript in the host Node.js process. The flaw affects @prompty/core versions <= 0.1.4 and the 2.0.0-alpha.1 through 2.0.0-beta.4 pre-releases, where the Nunjucks renderer permitted unrestricted member access, letting a malicious template walk constructor/prototype chains to reach a JavaScript execution primitive. No public exploit identified at time of analysis and it is not listed in CISA KEV, but the maximum CVSS of 10.0 and CWE-94 code-injection root cause make this a critical-priority patch for any app that renders untrusted, community-supplied, cloned, or LLM-generated .prompty files.
We need to produce a comprehensive analysis JSON for CVE-2026-53598, based on the provided data. The CVE involves Microsoft's Prompty (a markdown file format for LLM prompts), path traversal in file references, fixed in 2.0.0-beta.2. We have CVSS: 7.5, vector AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N, CWE-22. EPSS 1.06% (percentile 61%). Patch available. SSVC: Exploitation none, Automatable yes, Technical impact partial. CPE: cpe:2.3:a:microsoft:prompty:*:*:*:*:*:*:*:*. Versions fixed: 2.0.0b2 for PyPI, 2.0.0-beta.2 for npm, crates.io, NuGet. We have a GitHub Advisory detailing the vulnerability, affected packages, fix details. The commit diff shows the fix canonicalizing paths, restricting file references to within the prompt directory by default, and allowing host apps to provide additional allowed roots. The diff adds tests for traversal, absolute path, and symlink escape. Now we need to fill in the JSON fields. We'll synthesize from all sources. product_name: "Prompty" - the specific product name, as per instructions (1-3 words). "Microsoft Prompty" could work, but "Prompty" is sufficient. I'll use "Microsoft Prompty" to include vendor, but requirement: "NOT the vendor alone, NOT a description." So "Prompty" alone is fine and concise. Using "Prompty". summary: We must not copy or paraphrase description. Original synthesis using all data. Start with specific impact verb and product. So e.g., "Arbitrary file read in Microsoft Prompty before 2.0.0-beta.2 allows an attacker to read local files via crafted .prompty frontmatter file references." Mention that it allows path traversal, absolute paths, symlink escapes. Not actively exploited (KEV false, EPSS 1.06% low), POC exists? Not mentioned, but there are regression tests that demonstrate the attack, which could serve as proof-of-concept. But we'll state: "no public exploit identified at time of analysis" per rules, because no POC tag is provided. Wait, there's no explicit POC=YES in input, only the advisory and commi
Arbitrary JavaScript execution in Microsoft's @prompty/core TypeScript loader (2.0.0-alpha.1 through 2.0.0-beta.2) allows an attacker who supplies a crafted .prompty file to run code during prompt loading. The loader passed .prompty markdown to gray-matter without disabling its executable 'js'/'javascript' frontmatter engines, so a '---js' frontmatter block is evaluated as Node.js at parse time. Exploitation requires the victim's application to load the malicious file (UI:P); no public exploit is identified at time of analysis and it is not on CISA KEV, but the fix commit ships a working proof-of-concept test.
Server-side template injection leading to remote code execution in Microsoft's @prompty/core npm package (TypeScript runtime) allows an attacker who controls a .prompty template body to execute arbitrary JavaScript in the host Node.js process. The flaw affects @prompty/core versions <= 0.1.4 and the 2.0.0-alpha.1 through 2.0.0-beta.4 pre-releases, where the Nunjucks renderer permitted unrestricted member access, letting a malicious template walk constructor/prototype chains to reach a JavaScript execution primitive. No public exploit identified at time of analysis and it is not listed in CISA KEV, but the maximum CVSS of 10.0 and CWE-94 code-injection root cause make this a critical-priority patch for any app that renders untrusted, community-supplied, cloned, or LLM-generated .prompty files.
We need to produce a comprehensive analysis JSON for CVE-2026-53598, based on the provided data. The CVE involves Microsoft's Prompty (a markdown file format for LLM prompts), path traversal in file references, fixed in 2.0.0-beta.2. We have CVSS: 7.5, vector AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N, CWE-22. EPSS 1.06% (percentile 61%). Patch available. SSVC: Exploitation none, Automatable yes, Technical impact partial. CPE: cpe:2.3:a:microsoft:prompty:*:*:*:*:*:*:*:*. Versions fixed: 2.0.0b2 for PyPI, 2.0.0-beta.2 for npm, crates.io, NuGet. We have a GitHub Advisory detailing the vulnerability, affected packages, fix details. The commit diff shows the fix canonicalizing paths, restricting file references to within the prompt directory by default, and allowing host apps to provide additional allowed roots. The diff adds tests for traversal, absolute path, and symlink escape. Now we need to fill in the JSON fields. We'll synthesize from all sources. product_name: "Prompty" - the specific product name, as per instructions (1-3 words). "Microsoft Prompty" could work, but "Prompty" is sufficient. I'll use "Microsoft Prompty" to include vendor, but requirement: "NOT the vendor alone, NOT a description." So "Prompty" alone is fine and concise. Using "Prompty". summary: We must not copy or paraphrase description. Original synthesis using all data. Start with specific impact verb and product. So e.g., "Arbitrary file read in Microsoft Prompty before 2.0.0-beta.2 allows an attacker to read local files via crafted .prompty frontmatter file references." Mention that it allows path traversal, absolute paths, symlink escapes. Not actively exploited (KEV false, EPSS 1.06% low), POC exists? Not mentioned, but there are regression tests that demonstrate the attack, which could serve as proof-of-concept. But we'll state: "no public exploit identified at time of analysis" per rules, because no POC tag is provided. Wait, there's no explicit POC=YES in input, only the advisory and commi
Arbitrary JavaScript execution in Microsoft's @prompty/core TypeScript loader (2.0.0-alpha.1 through 2.0.0-beta.2) allows an attacker who supplies a crafted .prompty file to run code during prompt loading. The loader passed .prompty markdown to gray-matter without disabling its executable 'js'/'javascript' frontmatter engines, so a '---js' frontmatter block is evaluated as Node.js at parse time. Exploitation requires the victim's application to load the malicious file (UI:P); no public exploit is identified at time of analysis and it is not on CISA KEV, but the fix commit ships a working proof-of-concept test.