CVE-2026-53598
HighCVSS 7.5Exploitation Probability (EPSS)
Elevated risk61th percentile - higher than 61% of all known CVEs
Summary
In Prompty prior to version 2.0.0-beta.2, the loaders expanded ${file:...} references in .prompty frontmatter without validating that resolved paths stayed within the allowed directory, allowing an attacker-controlled prompt file to read local files via absolute paths, .. traversal, or symlink escapes.
Risk Assessment
The organization risks exposure of sensitive data such as configuration files, keys, or passwords if a malicious .prompty file is processed by the interpreter.
Recommendation
Upgrade Prompty to version 2.0.0-beta.2 or later immediately, which restricts file reference expansion to allowed paths.
Other vulnerabilities in Prompty
See all- CVE-2026-73299Critical
Prompty is a markdown file format (.prompty) for LLM prompts. Prior to 0.1.5 and 2.0.0-beta.5, the TypeScript Nunjucks renderer evaluated untrusted .prompty template bodies with unrestricted JavaScript member access. An attacker-controlled template could traverse constructor and prototype properties to execute JavaScript in the host Node.js process. This issue is fixed in versions 0.1.5 and 2.0.0-beta.5.
- CVE-2026-53597High
A vulnerability in the Prompty library allows arbitrary JavaScript execution when loading .prompty files. The TypeScript loader uses gray-matter without overriding default frontmatter engines, enabling an attacker to inject malicious code via a file with ---js frontmatter.
Original NVD description (English source)
Prompty is a markdown file format (.prompty) for LLM prompts. Prior to 2.0.0-beta.2, Prompty loaders expanded ${file:...} references in .prompty frontmatter without enforcing that resolved paths stayed within the prompt directory or allowed roots, allowing an attacker-controlled prompt file to read local files through absolute paths, .. traversal, or symlink escapes. This issue is fixed in versions 2.0.0-beta.2.