Attack Chain

1. An attacker crafts a malicious .prompty file containing a ${file:...} reference with a path traversal sequence (e.g., ${file:../etc/passwd}) or an absolute path (e.g., ${file:/etc/shadow}) in its frontmatter.
2. The attacker delivers this malicious .prompty file to a vulnerable application or convinces a victim to load it, targeting applications using PyPI prompty (<= 2.0.0b1), npm @prompty/core (<= 2.0.0-beta.1), crates.io prompty (<= 2.0.0-beta.1), or NuGet Prompty.Core (<= 2.0.0-beta.1).
3. The vulnerable application loads the untrusted .prompty file, which includes the frontmatter containing the crafted file reference.
4. The Prompty loader attempts to expand the ${file:...} reference during processing without properly validating the resolved path against authorized directories or canonicalizing it.
5. The Prompty library's internal logic resolves the path traversal or absolute path, causing the application to read the arbitrary file from the host system.
6. The content of the sensitive file (e.g., /etc/passwd, /etc/shadow, configuration files) is then processed by the application.
7. The application may log the content, include it in a response, or otherwise expose it, allowing the attacker to receive or extract the contents of the arbitrary file.
8. The attacker achieves sensitive information disclosure, obtaining unauthorized access to local system files.

Impact

Applications that process untrusted .prompty files are at severe risk of arbitrary file disclosure due to CVE-2026-53598. Successful exploitation could lead to attackers reading any file accessible to the vulnerable application's process, including critical configuration files, user credentials, application source code, or sensitive private data. While no specific victim counts are provided, any organization utilizing affected Prompty versions in environments that parse external or user-provided prompt files is vulnerable to significant information theft. The potential damage includes intellectual property loss, system compromise through leaked credentials, and privacy breaches if personal data is exposed.

Recommendation

• Upgrade all PyPI prompty installations to version 2.0.0b2 or higher immediately to remediate CVE-2026-53598.
• Upgrade all npm @prompty/core installations to 2.0.0-beta.2 or higher immediately to remediate CVE-2026-53598.
• Upgrade all crates.io prompty installations to 2.0.0-beta.2 or higher immediately to remediate CVE-2026-53598.
• Upgrade all NuGet Prompty.Core installations to 2.0.0-beta.2 or higher immediately to remediate CVE-2026-53598.
• Review application logs for CVE-2026-53598 exploitation attempts, specifically looking for prompty library operations attempting to access files outside expected asset directories.