Critical Prompty Flaw Turns a .prompty File Into Node.js RCE
A critical vulnerability has surfaced in Prompty, Microsoft’s open-source project for building applications on top of large language models. The flaw let a specially prepared .prompty file escape ordinary template processing and run arbitrary JavaScript with the privileges of the Node.js process. The vulnerability received the maximum score of 10 out of 10 on the CVSS scale.
Discovery and Affected Versions
Positive Technologies’ AppSec Research team found the issue while testing an AI-based vulnerability-hunting tool they are developing. The flaw was registered as CVE-2026-73299. It affected the TypeScript package @prompty/core in versions up to and including 0.1.4, as well as the branch up to and including 2.0.0-beta.4. Microsoft closed the hole in versions 0.1.5 and 2.0.0-beta.5.
What Prompty Does
Prompty combines the .prompty file format with tools for creating, testing, and running prompts in generative-AI applications. A file consists of a YAML configuration and a prompt body in Markdown. It may also contain model parameters, input data, tools, and template constructs. A developer can use a single file across different environments and connect various LLM providers.
An SSTI Flaw in the Nunjucks Renderer
The vulnerability belongs to the SSTI class, or Server-Side Template Injection. When processing .prompty files, the Nunjucks templating engine did not sufficiently restrict access to JavaScript objects. A specially formed template could reach the constructor and prototype properties, break out of the intended logic, and achieve JavaScript execution inside the Node.js process.
Impact of Exploitation
The consequences of exploitation depended on the privileges of the process running the application. With sufficient rights, an attacker could potentially access application data and secrets, alter files and settings, interfere with services, or disrupt their availability. The ability to execute arbitrary code with the application’s privileges was the reason for the maximum severity score.
Not a Simple Prompt Injection
An ordinary text query to a language model is insufficient to exploit CVE-2026-73299. The attack requires the application to use a vulnerable version of @prompty/core, process a .prompty file through Nunjucks, and receive a specially prepared template. Microsoft’s advisory specifically names untrusted, community-sourced, cloned, and LLM-generated .prompty files.
Elevated risk arises in systems that load such files from external repositories, accept them from third-party developers, or create them automatically with language models. In such scenarios, a prompt file can no longer be regarded as a purely textual instruction for an LLM, since its template logic is processed by a software component.
How Microsoft Fixed It
To resolve the problem, Microsoft changed the Nunjucks renderer. The corrected implementation permits access only to the own data of passed objects, blocks traversal through constructor and prototype, forbids function calls from templates, and sanitises input before processing. Variable substitution, conditions, loops, and access to ordinary user data continue to work.
The protection was also ported to the older @prompty/core branch. A separate fix added similar restrictions and tests against SSTI, after which version 0.1.5 appeared.
A Shifting Threat Model for AI Developers
The vulnerability shows how the growth of generative-AI tools is changing the threat model for developers. A prompt file may include configuration, template expressions, and other elements that affect an application’s behaviour. Obtaining such files from external sources therefore creates risks characteristic of the software supply chain.
Users of vulnerable @prompty/core versions should upgrade to at least version 0.1.5 in the old branch or 2.0.0-beta.5 in the new one.
Support Our Threat Intelligence
If you find our technology report and cybersecurity news helpful, consider supporting our work.
Buy Me a Coffee
PayPal
