CVE-2026-73299RCE in Prompty via TypeScript template injection
Prompty is a markdown file format (.prompty) for LLM prompts. Prior to 0.1.5 and 2.0.0-beta.5, the TypeScript Nunjucks renderer evaluated untrusted .prompty template bodies with unrestricted JavaScript member access. An attacker-controlled template could traverse constructor and prototype properties to execute JavaScript in the host Node.js process. This issue is fixed in versions 0.1.5 and 2.0.0-beta.5.
View on NVDAnalysis
La biblioteca Prompty para TypeScript permite a un atacante ejecutar código JavaScript arbitrario en el proceso de Node.js mediante la manipulación de plantillas .prompty. Al explotar una vulnerabilidad de inyección en el renderizador Nunjucks, es posible comprometer totalmente el entorno de ejecución del backend. Se recomienda actualizar inmediatamente a las versiones 0.1.5 o 2.0.0-beta.5 para mitigar este riesgo de ejecución remota de código.
Relevant roles
Severity
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:HCWE-94CWE-1336EPSS
No EPSS score yet (CVE may be too fresh).
Technical description
Prompty is a markdown file format (.prompty) for LLM prompts. Prior to 0.1.5 and 2.0.0-beta.5, the TypeScript Nunjucks renderer evaluated untrusted .prompty template bodies with unrestricted JavaScript member access. An attacker-controlled template could traverse constructor and prototype properties to execute JavaScript in the host Node.js process. This issue is fixed in versions 0.1.5 and 2.0.0-beta.5.
References
- https://github.com/microsoft/prompty/commit/e4a0ebf49e3a78d5d7796c8480bf9a4f0c54d19e
- https://github.com/microsoft/prompty/commit/f5c57c94a0990cca79d095c3daab661b4b1fb89f
- https://github.com/microsoft/prompty/pull/404
- https://github.com/microsoft/prompty/pull/405
- https://github.com/microsoft/prompty/security/advisories/GHSA-w28w-gp39-m4p6
- https://github.com/microsoft/prompty/tree/typescript/2.0.0-beta.5