CVE-2026-53597

Prompty is a markdown file format (

Prompty is a markdown file format (.prompty) for LLM prompts. From 2.0.0-alpha.1 until 2.0.0-beta.3, the @prompty/core TypeScript loader in runtime/typescript/packages/core/src/core/loader.ts used gray-matter without overriding executable js and javascript frontmatter engines, allowing an attacker-controlled .prompty file with ---js frontmatter to execute arbitrary JavaScript during prompt loading. This issue is fixed in version 2.0.0-beta.3.

Published

16 Jul 2026 16:19

Modified

18 Jul 2026 03:16

Source

CIRCL

Weaknesses (CWE)

CWE-94

References

github.com /microsoft/prompty/commit/c27402da2487075be577f06aa79df627fb9d6853 github.com /microsoft/prompty/security/advisories/GHSA-c4gh-rv8h-q9vw

Affected Systems

No vendor data available.

External Links

NVD Database CIRCL CISA KEV

KEV Status

Not in CISA KEV catalog