Prompty vulnerabilities

Prompty is a markdown file format (.prompty) for LLM prompts. Prior to 0.1.5 and 2.0.0-beta.5, the TypeScript Nunjucks renderer evaluated untrusted .prompty template bodies with unrestricted JavaScript member access. An attacker-controlled template could traverse constructor and prototype properties to execute JavaScript in the host Node.js process. This issue is fixed in versions 0.1.5 and 2.0.0-beta.5.

In Prompty prior to version 2.0.0-beta.2, the loaders expanded ${file:...} references in .prompty frontmatter without validating that resolved paths stayed within the allowed directory, allowing an attacker-controlled prompt file to read local files via absolute paths, .. traversal, or symlink escapes.

A vulnerability in the Prompty library allows arbitrary JavaScript execution when loading .prompty files. The TypeScript loader uses gray-matter without overriding default frontmatter engines, enabling an attacker to inject malicious code via a file with ---js frontmatter.