3vulnerabilities
- Critical1 (33.3%)
- High2 (66.7%)
- Medium0 (0.0%)
- Moderate0 (0.0%)
- Low0 (0.0%)
prompty-core
Ecosystem: npm
Downloads: 1.25 K
- 1CriticalAffects 2 versions
- 2HighAffects 2 versions
- 0MediumAffects 0 versions
- 0ModerateAffects 0 versions
- 0LowAffects 0 versions
Monthly breakdown
- 3 vulnerabilities
- Critical: 1
- High: 2
- Medium: 0
- Moderate: 0
- Low: 0
Vulnerabilities (3)
Known vulnerabilities affecting prompty-core, based on data from OSV.
| ID | Severity | Summary | Affected versions | Published | Source |
|---|---|---|---|---|---|
| GHSA-w28w-gp39-m4p6 | Critical | Prompty: Server-Side Template Injection to Remote Code Execution in the @prompty/core Nunjucks Renderer## Summary The TypeScript Nunjucks renderer evaluated untrusted `.prompty` template bodies with unrestricted JavaScript member access. An attacker-controlled template could traverse constructor and prototype properties to execute JavaScript in the host Node.js process. ## Affected packages - npm `@prompty/core` versions `<= 0.1.4` - npm `@prompty/core` versions `<= 2.0.0-beta.4` ## Impact Applications that render untrusted, community-supplied, cloned, or LLM-generated `.prompty` files with the TypeScript runtime could allow attacker-controlled code execution with the privileges of the Node.j |
| GitHub (opens in a new tab) | |
| GHSA-c4gh-rv8h-q9vw | High | Prompty: Arbitrary code execution via JavaScript frontmatter in TypeScript loader## Summary The TypeScript Prompty loader used `gray-matter` without overriding executable frontmatter engines. `gray-matter` supports JavaScript frontmatter blocks such as `---js` and evaluates them while parsing. An attacker-controlled `.prompty` file could therefore execute arbitrary JavaScript during prompt loading. ## Affected package - npm `@prompty/core` v2 prerelease line: `>= 2.0.0-alpha.1 < 2.0.0-beta.3` - Fixed in `@prompty/core@2.0.0-beta.3` The legacy v1 JavaScript runtime had a historical hardening change for this issue. During the v2 TypeScript runtime rebuild, the loader again |
| GitHub (opens in a new tab) | |
| GHSA-wxhm-2mq7-7697 | High | Prompty: Arbitrary file read via file reference expansion## Summary Prompty loaders expanded `${file:...}` references in `.prompty` frontmatter without enforcing that the resolved path stayed within an authorized directory. An attacker-controlled prompt file could use path traversal or an absolute path to cause the host application to read files accessible to the process. ## Affected packages - PyPI `prompty` versions `<= 2.0.0b1`; fixed in `2.0.0b2` - npm `@prompty/core` versions `<= 2.0.0-beta.1`; fixed in `2.0.0-beta.2` - crates.io `prompty` versions `<= 2.0.0-beta.1`; fixed in `2.0.0-beta.2` - NuGet `Prompty.Core` versions `<= 2.0.0-beta.1`; fi |
| GitHub (opens in a new tab) |
- GHSA-w28w-gp39-m4p6CriticalPrompty: Server-Side Template Injection to Remote Code Execution in the @prompty/core Nunjucks Renderer
< 0.1.5>= 2.0.0-alpha.1, < 2.0.0-beta.5
## Summary The TypeScript Nunjucks renderer evaluated untrusted `.prompty` template bodies with unrestricted JavaScript member access. An attacker-controlled template could traverse constructor and prototype properties to execute JavaScript in the host Node.js process. ## Affected packages - npm `@prompty/core` versions `<= 0.1.4` - npm `@prompty/core` versions `<= 2.0.0-beta.4` ## Impact Applications that render untrusted, community-supplied, cloned, or LLM-generated `.prompty` files with the TypeScript runtime could allow attacker-controlled code execution with the privileges of the Node.j
CVE: CVE-2026-73299
- GHSA-c4gh-rv8h-q9vwHighPrompty: Arbitrary code execution via JavaScript frontmatter in TypeScript loader
>= 2.0.0-alpha.1, < 2.0.0-beta.3
## Summary The TypeScript Prompty loader used `gray-matter` without overriding executable frontmatter engines. `gray-matter` supports JavaScript frontmatter blocks such as `---js` and evaluates them while parsing. An attacker-controlled `.prompty` file could therefore execute arbitrary JavaScript during prompt loading. ## Affected package - npm `@prompty/core` v2 prerelease line: `>= 2.0.0-alpha.1 < 2.0.0-beta.3` - Fixed in `@prompty/core@2.0.0-beta.3` The legacy v1 JavaScript runtime had a historical hardening change for this issue. During the v2 TypeScript runtime rebuild, the loader again
CVE: CVE-2026-53597
- GHSA-wxhm-2mq7-7697HighPrompty: Arbitrary file read via file reference expansion
< 2.0.0-beta.2
## Summary Prompty loaders expanded `${file:...}` references in `.prompty` frontmatter without enforcing that the resolved path stayed within an authorized directory. An attacker-controlled prompt file could use path traversal or an absolute path to cause the host application to read files accessible to the process. ## Affected packages - PyPI `prompty` versions `<= 2.0.0b1`; fixed in `2.0.0b2` - npm `@prompty/core` versions `<= 2.0.0-beta.1`; fixed in `2.0.0-beta.2` - crates.io `prompty` versions `<= 2.0.0-beta.1`; fixed in `2.0.0-beta.2` - NuGet `Prompty.Core` versions `<= 2.0.0-beta.1`; fi
CVE: CVE-2026-53598