Attack Chain

1. An attacker crafts a malicious .prompty template body containing Nunjucks SSTI payloads designed to exploit JavaScript member access.
2. The attacker delivers this malicious template to a vulnerable application using the @prompty/core renderer.
3. The vulnerable application ingests and attempts to render the untrusted .prompty file.
4. During rendering, the @prompty/core Nunjucks renderer evaluates the template body, which includes the attacker's payload.
5. Due to unrestricted JavaScript member access, the payload successfully traverses constructor and prototype properties of JavaScript objects within the Node.js runtime.
6. This traversal allows the attacker to execute arbitrary JavaScript code within the context of the host Node.js process.
7. Remote Code Execution (RCE) is achieved, giving the attacker control over the server with the application's privileges.

Impact

Applications that utilize the @prompty/core library and render untrusted .prompty files are at severe risk. A successful exploitation of this critical vulnerability leads to remote code execution (RCE) on the server. Attackers can leverage this access to steal sensitive data, deploy further malware, establish persistence, or completely compromise the affected system. The impact extends to any data managed by the Node.js application and the underlying operating system. The vulnerability's severity is critical due to the direct path from untrusted input to arbitrary code execution, potentially affecting a broad range of applications that integrate with external template sources, such as those involving user-generated content or LLM integrations.

Recommendation

• Upgrade all instances of @prompty/core to version 2.0.0-beta.5 or later immediately to apply the security patch. The patched renderer sanitizes render inputs, rejects constructor/prototype member traversal, and disallows template function calls, while maintaining support for ordinary interpolation, conditionals, loops, and own nested data properties.