Prompty - CraftedSignal Threat Feed

Arbitrary Code Execution via JavaScript Frontmatter in Prompty TypeScript Loader

hello@craftedsignal.io — Fri, 17 Jul 2026 19:54:50 +0000

A critical vulnerability, tracked as CVE-2026-53597, affects the Prompty TypeScript loader, specifically the @prompty/core npm package in versions >= 2.0.0-alpha.1 up to but not including 2.0.0-beta.3. The vulnerability stems from the library's use of gray-matter for parsing frontmatter in .prompty files without properly disabling or overriding executable frontmatter engines. gray-matter, by default, supports and evaluates JavaScript frontmatter blocks, indicated by ---js. This oversight allows an attacker to craft a malicious .prompty file containing arbitrary JavaScript code within such a block. When an application loads and parses this untrusted file, the embedded JavaScript is executed in the context of the host Node.js process, leading to arbitrary code execution. This poses a significant risk to applications that process user-provided or untrusted .prompty files, prompt paths, or prompt bundles.

Attack Chain

An attacker crafts a malicious .prompty file containing a ---js frontmatter block.
Within this JavaScript frontmatter block, the attacker embeds arbitrary JavaScript code designed to achieve their objective (e.g., remote code execution, data exfiltration).
The attacker delivers this malicious .prompty file to a victim organization, potentially through social engineering or by placing it in an accessible repository.
A victim application, utilizing the vulnerable @prompty/core package (versions >= 2.0.0-alpha.1 < 2.0.0-beta.3), loads or processes the untrusted .prompty file.
During the parsing process, @prompty/core invokes the gray-matter library to extract and process the file's frontmatter.
As @prompty/core does not override gray-matter's default behavior, the ---js frontmatter engine is activated and the embedded JavaScript code is evaluated.
The attacker's arbitrary JavaScript payload executes with the permissions of the Node.js process running the victim application.
This leads to arbitrary code execution on the host system, potentially enabling system compromise, data theft, or further lateral movement within the network.

Impact

Applications that load untrusted .prompty files or prompt bundles from less-trusted locations are susceptible to arbitrary JavaScript execution. If exploited, an attacker could execute arbitrary code within the host Node.js process, potentially leading to full system compromise, data exfiltration, or disruption of service. This can result in significant financial, reputational, and operational damage, depending on the privileges and sensitive data accessible by the compromised Node.js application. While specific victim counts are not available, any organization deploying applications using the vulnerable @prompty/core versions that handle untrusted inputs is at risk.

Recommendation

Upgrade the @prompty/core package to version 2.0.0-beta.3 or later immediately to remediate the CVE-2026-53597 vulnerability.
Ensure that application environments are configured to prevent the execution of untrusted code, even if a parsing vulnerability exists.

Prompty Arbitrary File Read Vulnerability via File Reference Expansion (CVE-2026-53598)

hello@craftedsignal.io — Fri, 17 Jul 2026 19:47:13 +0000

CVE-2026-53598 describes an arbitrary file read vulnerability affecting Prompty libraries across multiple ecosystems, including PyPI prompty (versions <= 2.0.0b1), npm @prompty/core (versions <= 2.0.0-beta.1), crates.io prompty (versions <= 2.0.0-beta.1), and NuGet Prompty.Core (versions <= 2.0.0-beta.1). This flaw stems from improper validation of ${file:...} references within .prompty frontmatter, allowing path traversal (../) or absolute paths to read files outside the intended directory. Threat actors could exploit this by providing a specially crafted .prompty file to a vulnerable application, leading to the disclosure of sensitive local files accessible to the application's process. The vulnerability was patched in versions 2.0.0b2 and 2.0.0-beta.2, which enforce stricter path restrictions and canonicalization.

Attack Chain

An attacker crafts a malicious .prompty file containing a ${file:...} reference with a path traversal sequence (e.g., ${file:../etc/passwd}) or an absolute path (e.g., ${file:/etc/shadow}) in its frontmatter.
The attacker delivers this malicious .prompty file to a vulnerable application or convinces a victim to load it, targeting applications using PyPI prompty (<= 2.0.0b1), npm @prompty/core (<= 2.0.0-beta.1), crates.io prompty (<= 2.0.0-beta.1), or NuGet Prompty.Core (<= 2.0.0-beta.1).
The vulnerable application loads the untrusted .prompty file, which includes the frontmatter containing the crafted file reference.
The Prompty loader attempts to expand the ${file:...} reference during processing without properly validating the resolved path against authorized directories or canonicalizing it.
The Prompty library's internal logic resolves the path traversal or absolute path, causing the application to read the arbitrary file from the host system.
The content of the sensitive file (e.g., /etc/passwd, /etc/shadow, configuration files) is then processed by the application.
The application may log the content, include it in a response, or otherwise expose it, allowing the attacker to receive or extract the contents of the arbitrary file.
The attacker achieves sensitive information disclosure, obtaining unauthorized access to local system files.

Impact

Applications that process untrusted .prompty files are at severe risk of arbitrary file disclosure due to CVE-2026-53598. Successful exploitation could lead to attackers reading any file accessible to the vulnerable application's process, including critical configuration files, user credentials, application source code, or sensitive private data. While no specific victim counts are provided, any organization utilizing affected Prompty versions in environments that parse external or user-provided prompt files is vulnerable to significant information theft. The potential damage includes intellectual property loss, system compromise through leaked credentials, and privacy breaches if personal data is exposed.

Recommendation

Upgrade all PyPI prompty installations to version 2.0.0b2 or higher immediately to remediate CVE-2026-53598.
Upgrade all npm @prompty/core installations to 2.0.0-beta.2 or higher immediately to remediate CVE-2026-53598.
Upgrade all crates.io prompty installations to 2.0.0-beta.2 or higher immediately to remediate CVE-2026-53598.
Upgrade all NuGet Prompty.Core installations to 2.0.0-beta.2 or higher immediately to remediate CVE-2026-53598.
Review application logs for CVE-2026-53598 exploitation attempts, specifically looking for prompty library operations attempting to access files outside expected asset directories.