Microsoft Prompty SSTI to RCE in Nunjucks Renderer

Executive brief

Prompty is a library used to manage and render prompt templates for AI applications. A security flaw allows attackers to use specially crafted template files to run unauthorized commands on the server hosting the application. This could lead to a full system takeover, data theft, or disruption of services.

Technical details

A Server-Side Template Injection (SSTI) vulnerability exists in the @prompty/core Nunjucks renderer. The renderer fails to restrict JavaScript member access when evaluating .prompty template bodies, allowing an attacker to traverse 'constructor' and 'prototype' properties. By supplying a malicious template—whether through community-supplied files, cloned repositories, or LLM-generated content—a remote attacker can execute arbitrary JavaScript within the context of the host Node.js process. The vulnerability is addressed in version 2.0.0-beta.5 by sanitizing inputs, rejecting member traversal, and disabling template function calls.

Affected products

• Microsoft @prompty/core <= 0.1.4, >= 2.0.0-alpha.1, <= 2.0.0-beta.4

Timeline

• 2026-07-20: disclosed
• 2026-07-24: advisory: GitHub Advisory published

References

• https://api.github.com/users/lexdotdev
• https://github.com/lexdotdev
• https://api.github.com/users/lexdotdev/gists%7B/gist_id%7D
• https://api.github.com/users/lexdotdev/repos
• https://avatars.githubusercontent.com/u/83035922?v=4
• https://api.github.com/users/lexdotdev/events%7B/privacy%7D