Executive brief
Microsoft Prompty is a library used for managing and loading AI prompt templates. A security vulnerability in its TypeScript loader allows an attacker to execute malicious code on a server if the application loads a specially crafted prompt file. This could lead to a full system compromise, unauthorized data access, or service disruption.
Technical details
The vulnerability is a code injection (CWE-94) issue within the TypeScript loader of @prompty/core. The loader utilizes the 'gray-matter' library to parse frontmatter but failed to disable or override executable engines. Consequently, 'gray-matter' evaluates JavaScript blocks (e.g., ---js) by default during parsing. An attacker who can provide a malicious .prompty file or influence the path from which prompts are loaded can achieve arbitrary JavaScript execution within the host Node.js process. The issue was a regression in the v2 TypeScript rebuild and has been fixed in version 2.0.0-beta.3 by explicitly overriding the 'js' and 'javascript' engines to reject such content.
Affected products
- Microsoft @prompty/core >= 2.0.0-alpha.1, < 2.0.0-beta.3
Timeline
- 2026-06-06: disclosed: Reported to Microsoft
- 2026-07-16: advisory: NVD publication date
- 2026-07-17: patched: GitHub Advisory published and fix confirmed in 2.0.0-beta.3
References
- https://api.github.com/users/cristianstaicu
- https://github.com/cristianstaicu
- https://api.github.com/users/cristianstaicu/gists%7B/gist_id%7D
- https://api.github.com/users/cristianstaicu/repos
- https://avatars.githubusercontent.com/u/1549455?v=4
- https://api.github.com/users/cristianstaicu/events%7B/privacy%7D