CVE-2026-53598: Microsoft Prompty path traversal in file reference expansion

CVE-2026-53598 · Severity: high · CVSS 7.5 · Published 2026-07-16

Prompty is a tool used to manage and load prompts for Large Language Models (LLMs). A security flaw in how it handles file references allows an attacker to create a malicious prompt file that can read sensitive files from the server or computer running the application. This could lead to the exposure of private data, configuration files, or credentials accessible to the application process.

Technologies: Microsoft Prompty. Vendors: Microsoft, npm, PyPI.

Quick answers

Is CVE-2026-53598 exploited in the wild?
No. Junglewise Threat Intelligence has no report of CVE-2026-53598 being exploited in the wild.
How severe is CVE-2026-53598?
High severity, with a CVSS score of 7.5, published 16 July 2026.
Which products and versions are affected?
Microsoft Prompty < 2.0.0-beta.2 (npm, NuGet, Rust, pip), <= 2.0.0b1; Microsoft prompty (Rust) <= 2.0.0-beta.1; @prompty/core (npm) <= 2.0.0-beta.1, SEMVER:introduced=0,fixed=2.0.0-beta.2; prompty (PyPI) ECOSYSTEM:introduced=0,fixed=2.0.0b2.
Is there a fix for CVE-2026-53598?
Yes. @prompty/core (npm): upgrade to 2.0.0-beta.2 or later; prompty (PyPI): upgrade to 2.0.0b2 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
How is CVE-2026-53598 attacked?
It is attacked over the network, in a software library.
Am I affected by CVE-2026-53598?
Check whether you run Microsoft Prompty, Microsoft prompty (Rust), @prompty/core (npm) or one of the others listed at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

How to fix

  • @prompty/core (npm): upgrade to 2.0.0-beta.2 or later
    npm install @prompty/core@2.0.0-beta.2
  • prompty (PyPI): upgrade to 2.0.0b2 or later
    pip install "prompty>=2.0.0b2"

Technical details

A path traversal vulnerability exists in Prompty loaders across multiple ecosystems (Python, JavaScript, Rust, and .NET). The vulnerability stems from the improper validation of `${file:...}` references in the frontmatter of `.prompty` files. An attacker can provide a crafted prompt file using absolute paths or '..' traversal sequences to bypass intended directory restrictions. If an application loads such a file, the loader will resolve and read files outside the authorized directory, potentially disclosing sensitive information if the content is subsequently logged or returned to the user. The fix implements path canonicalization and restricts resolution to the prompt's directory tree unless additional roots are explicitly configured.

Affected products

  • Microsoft prompty <= 2.0.0b1
  • Microsoft @prompty/core <= 2.0.0-beta.1
  • Microsoft Prompty.Core <= 2.0.0-beta.1
  • Microsoft prompty (Rust) <= 2.0.0-beta.1

Identifiers

  • CVE-2026-53598
  • GHSA-wxhm-2mq7-7697
  • PYSEC-2026-3538

Timeline

  • 2026-06-05: patched: Fix commit 88ac9948d7d37995edbb2f6d36913436626c39e1 authored
  • 2026-06-06: disclosed: Advisory published by Microsoft on GitHub
  • 2026-07-16: advisory: NVD published the CVE record
  • 2026-07-17: advisory: GitHub Advisory Database entry updated

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.