{"id":"CVE-2026-53597","aliases":["GHSA-c4gh-rv8h-q9vw"],"title":"Prompty: Arbitrary code execution via JavaScript frontmatter in TypeScript loader","summary":"Prompty: Arbitrary code execution via JavaScript frontmatter in TypeScript loader","severity":"high","cwe":["CWE-94"],"vendor":"prompty","product":"@prompty/core","ecosystem":"npm","affected":["@prompty/core >= 2.0.0-alpha.1, < 2.0.0-beta.3"],"patched":["@prompty/core 2.0.0-beta.3"],"published":"2026-07-17","updated":"2026-07-17","source":"GHSA","sourceUrl":"https://github.com/advisories/GHSA-c4gh-rv8h-q9vw","references":[{"url":"https://github.com/microsoft/prompty/security/advisories/GHSA-c4gh-rv8h-q9vw"},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-53597"},{"url":"https://github.com/microsoft/prompty/commit/c27402da2487075be577f06aa79df627fb9d6853"},{"url":"https://github.com/advisories/GHSA-c4gh-rv8h-q9vw"}],"tags":["ghsa","npm"],"epss":0.00972,"epssPercentile":0.59939,"ingestedAt":"2026-07-17T20:15:43.265Z","slug":"CVE-2026-53597","body":"## Overview\n\n## Summary\nThe TypeScript Prompty loader used `gray-matter` without overriding executable frontmatter engines. `gray-matter` supports JavaScript frontmatter blocks such as `---js` and evaluates them while parsing. An attacker-controlled `.prompty` file could therefore execute arbitrary JavaScript during prompt loading.\n\n## Affected package\n- npm `@prompty/core` v2 prerelease line: `>= 2.0.0-alpha.1 < 2.0.0-beta.3`\n- Fixed in `@prompty/core@2.0.0-beta.3`\n\nThe legacy v1 JavaScript runtime had a historical hardening change for this issue. During the v2 TypeScript runtime rebuild, the loader again called `gray-matter` directly and the vulnerable behavior was present in the v2 prerelease packages until `2.0.0-beta.3`.\n\n## Impact\nApplications that load untrusted `.prompty` files, user-provided prompt paths, or prompt bundles from less-trusted locations could execute arbitrary JavaScript in the host Node.js process during frontmatter parsing.\n\n## Remediation\nUpgrade `@prompty/core` to `2.0.0-beta.3` or later.\n\nThe fix explicitly overrides the `js` and `javascript` gray-matter engines and rejects JavaScript frontmatter in `.prompty` files. Prompty frontmatter is YAML-only; executable frontmatter is unsupported. A regression test now verifies that `---js` frontmatter is rejected and not evaluated.\n\n## Fix details\nFixed by commit `c27402da2487075be577f06aa79df627fb9d6853` and released via `typescript/2.0.0-beta.3`.\n\n## Affected packages\n\n- `@prompty/core >= 2.0.0-alpha.1, < 2.0.0-beta.3`\n\n## Remediation\n\nUpgrade to a patched release:\n\n- `@prompty/core 2.0.0-beta.3`","depth":"twilight","depthScore":41,"depthScoreParts":{"impact":41.3,"likelihood":0.2,"exploitation":0,"ransomware":0},"changes":[]}