Description

Prompty is a markdown file format (.prompty) for LLM prompts. Prior to 0.1.5 and 2.0.0-beta.5, the TypeScript Nunjucks renderer evaluated untrusted .prompty template bodies with unrestricted JavaScript member access. An attacker-controlled template could traverse constructor and prototype properties to execute JavaScript in the host Node.js process. This issue is fixed in versions 0.1.5 and 2.0.0-beta.5.

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "10.0",
  "pubDate": "2026-08-12T18:18:15.197Z",
  "pubdate": "2026-08-12T18:18:15.197Z",
  "executiveSummary": "A remote code execution vulnerability exists in the Prompty markdown file format (.prompty) TypeScript Nunjucks renderer prior to versions 0.1.5 and 2.0.0-beta.5. The vulnerability arises from insecure evaluation of untrusted template bodies, which permits unrestricted JavaScript member access during the rendering process. An attacker capable of supplying or modifying a malicious .prompty template can leverage this flaw to traverse constructor and prototype properties, ultimately escaping the template sandbox and executing arbitrary JavaScript code within the context of the host Node.js process. The impact of successful exploitation is severe, as it grants full code execution capabilities to the attacker on the underlying system hosting the vulnerable renderer. This poses significant risk implications, potentially leading to complete system compromise, data exfiltration, or lateral movement depending on the privileges of the Node.js process. Exploitation requires the processing of a maliciously crafted .prompty file containing specially designed template payloads that exploit the unrestricted member access behavior of the Nunjucks renderer.",
  "technicalDetails": "The root cause of the vulnerability resides within the TypeScript Nunjucks renderer implementation used to process .prompty file formats. During the template evaluation phase, the rendering engine fails to properly restrict or sanitize property access on objects exposed within the template execution context. Specifically, the template engine allows unrestricted JavaScript member access, which fails to block traversal vectors targeting constructor and prototype chains.\nThe vulnerable component is the Nunjucks template rendering module handling .prompty template bodies in versions prior to 0.1.5 and 2.0.0-beta.5. The attack flow begins when an application processes an attacker-controlled or untrusted .prompty file. Because member access is unrestricted, an attacker can craft a malicious template payload that accesses the constructor property of standard JavaScript objects (such as strings, arrays, or generic objects), subsequently navigating through the prototype chain to reach internal functions or module loaders available in the Node.js runtime environment.\nBy manipulating the constructor and prototype properties, the attacker can instantiate powerful built-in Node.js modules or functions—such as child_process or fs—enabling the execution of arbitrary operating system commands or arbitrary JavaScript code within the host Node.js process. The exploitation method does not inherently require authentication or specific privilege levels within the application itself, provided the application accepts and renders the attacker-supplied .prompty template body. Network exposure and post-exploitation impact depend directly on the privileges assigned to the host Node.js process executing the renderer, potentially allowing attackers to read sensitive files, interact with internal network resources, or spawn reverse shells."
}