by Kastro
Paper/Archive/CVE-2026-73299

CVE-2026-73299

microsoft prompty — Prompty: Server-Side Template Injection to Remote Code Execution in the @prompty/core Nunjucks Renderer

EPSS 2%CVSS 10.0
critical.is priorityof 100
46
CVSS 10.0 (CNA)10.0 / 10 × 3030.0Not in CISA KEV+300.0EPSS percentile 78.3.783 × 2015.7No public exploit+100.0SSVC exploitation: none+100.0
Description · from the CVE record

Prompty is a markdown file format (.prompty) for LLM prompts. Prior to 0.1.5 and 2.0.0-beta.5, the TypeScript Nunjucks renderer evaluated untrusted .prompty template bodies with unrestricted JavaScript member access. An attacker-controlled template could traverse constructor and prototype properties to execute JavaScript in the host Node.js process. This issue is fixed in versions 0.1.5 and 2.0.0-beta.5.

Affected

ProductAffectedFixed inSource
prompty< 0.1.5–CNA
prompty>= 2.0.0-alpha.1, < 2.0.0-beta.5–CNA

Scores by source

GitHub_M (CNA)10.0CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H
CISA ADPSSVCExploitation: none · Automatable: yes · Technical impact: total

References

refgithub.com/microsoft/prompty/security/advisories/GHSA-w28w-gp39-m4p6refgithub.com/microsoft/prompty/pull/404refgithub.com/microsoft/prompty/pull/405refgithub.com/microsoft/prompty/commit/e4a0ebf49e3a78d5d7796c8480bf9a4f0c54d19erefgithub.com/microsoft/prompty/commit/f5c57c94a0990cca79d095c3daab661b4b1fb89frefgithub.com/microsoft/prompty/tree/typescript/2.0.0-beta.5