Executive brief
Prompty is a tool used to manage and load prompts for Large Language Models (LLMs). A security flaw in how it handles file references allows an attacker to create a malicious prompt file that can read sensitive files from the server or computer running the application. This could lead to the exposure of private data, configuration files, or credentials accessible to the application process.
Technical details
A path traversal vulnerability exists in Prompty loaders across multiple ecosystems (Python, JavaScript, Rust, and .NET). The vulnerability stems from the improper validation of `${file:...}` references in the frontmatter of `.prompty` files. An attacker can provide a crafted prompt file using absolute paths or '..' traversal sequences to bypass intended directory restrictions. If an application loads such a file, the loader will resolve and read files outside the authorized directory, potentially disclosing sensitive information if the content is subsequently logged or returned to the user. The fix implements path canonicalization and restricts resolution to the prompt's directory tree unless additional roots are explicitly configured.
Affected products
- Microsoft prompty <= 2.0.0b1
- Microsoft @prompty/core <= 2.0.0-beta.1
- Microsoft Prompty.Core <= 2.0.0-beta.1
- Microsoft prompty (Rust) <= 2.0.0-beta.1
Timeline
- 2026-06-05: patched: Fix commit 88ac9948d7d37995edbb2f6d36913436626c39e1 authored
- 2026-06-06: disclosed: Advisory published by Microsoft on GitHub
- 2026-07-16: advisory: NVD published the CVE record
- 2026-07-17: advisory: GitHub Advisory Database entry updated