CVE-2026-73299criticalCWE-1336CWE-94

CVE-2026-73299: falha crítica em microsoft prompty

Prompty: Server-Side Template Injection to Remote Code Execution in the @prompty/core Nunjucks Renderer

Publicada em

Seguir esta CVE+ Monitorar prompty+ Monitorar @prompty/core

Aviso por e-mail quando ela entrar no KEV, ganhar PoC pública ou subir de nota.

28Vexday Risk Score

Sem sinal de exploração. Nenhum artefato público de exploração conhecido até agora.

ssvc Trackcvss 10epss 1.8%
Prompty is a markdown file format (.prompty) for LLM prompts. Prior to 0.1.5 and 2.0.0-beta.5, the TypeScript Nunjucks renderer evaluated untrusted .prompty template bodies with unrestricted JavaScript member access. An attacker-controlled template could traverse constructor and prototype properties to execute JavaScript in the host Node.js process. This issue is fixed in versions 0.1.5 and 2.0.0-beta.5.
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H
Produtos afetados
microsoft · prompty
CVEs relacionadas — microsoft prompty

No mesmo produto, das mais perigosas para as menos.

CVE-2026-53598HIGHPrompty: Arbitrary File Read via ${file:path} Reference ExpansionEPSS 1.3%CVE-2026-53597HIGHPrompty: Arbitrary code execution via JavaScript frontmatter in TypeScript loaderEPSS 1.0%