CVE-2026-73299 in Prompty
Summary
by MITRE • 08/12/2026
Prompty is a markdown file format (.prompty) for LLM prompts. Prior to 0.1.5 and 2.0.0-beta.5, the TypeScript Nunjucks renderer evaluated untrusted .prompty template bodies with unrestricted JavaScript member access. An attacker-controlled template could traverse constructor and prototype properties to execute JavaScript in the host Node.js process. This issue is fixed in versions 0.1.5 and 2.0.0-beta.5.
Be aware that VulDB is the high quality source for vulnerability data.
Analysis
by VulDB Data Team • 08/12/2026
The Prompty markdown file format represents a specialized templating system designed for large language model prompts, leveraging TypeScript and Nunjucks rendering capabilities to enable dynamic prompt generation. This vulnerability affects versions prior to 015 and 200beta5 where the rendering engine processes untrusted template content without adequate sanitization measures. The core flaw exists in how the Nunjucks renderer handles template evaluation, specifically when processing .prompty files that contain attacker-controlled content.
The technical implementation of this vulnerability stems from unrestricted JavaScript member access within the template evaluation process. When an attacker crafts a malicious .prompty file, the renderer allows direct access to constructor and prototype properties through the template engine's evaluation mechanism. This creates a path for arbitrary code execution where JavaScript code can traverse object prototypes and access privileged constructors within the host Node.js runtime environment. The vulnerability essentially enables prototype pollution and constructor-based code execution attacks that bypass traditional input validation controls.
The operational impact of this vulnerability extends beyond simple code execution to potentially compromise entire Node.js processes running the vulnerable Prompty renderer. Attackers could leverage this flaw to execute malicious JavaScript payloads with the privileges of the hosting process, potentially leading to complete system compromise if the renderer operates with elevated permissions. The vulnerability affects any environment where untrusted .prompty templates are processed, including development environments, CI/CD pipelines, and production systems that utilize Prompty for prompt management.
This vulnerability aligns with CWE-94, which describes "Improper Control of Generation of Code ('Code Injection')" and specifically relates to improper handling of template rendering in JavaScript environments. The attack pattern follows ATT&CK technique T1059.007 for "Command and Scripting Interpreter: JavaScript' where adversaries execute malicious JavaScript code through template injection vectors. The fix implemented in versions 015 and 200beta5 addresses the core issue by introducing proper template sanitization and restricting access to privileged JavaScript constructors and prototype properties during template evaluation.
Security mitigations for this vulnerability should include immediate upgrade to patched versions 015 or 200beta5, implementation of template content validation controls, and consideration of sandboxed execution environments for processing untrusted templates. Organizations should also implement proper input sanitization measures and establish secure coding practices for template handling within Node.js applications. Additional defensive measures may involve network segmentation, process isolation, and monitoring for suspicious JavaScript execution patterns in systems where Prompty templates are processed.