Skip to content
OpenAdvisories

Product · Microsoft

prompty

3 known vulnerabilities.

All Critical High Medium Low Exploited only Public exploit

1 result · Clear filters · Feed

  • Critical 10.0
    CVE-2026-73299

    Prompty: Server-Side Template Injection to Remote Code Execution in the @prompty/core Nunjucks Renderer

    Prompty is a markdown file format (.prompty) for LLM prompts. Prior to 0.1.5 and 2.0.0-beta.5, the TypeScript Nunjucks renderer evaluated untrusted .prompty template bodies with unrestricted JavaScript member access. An attacker-controlled template could trav…

    Microsoft prompty @prompty/core npm