---
id: CVE-2026-53597
aliases:
  - GHSA-c4gh-rv8h-q9vw
title: >-
  Prompty: Arbitrary code execution via JavaScript frontmatter in TypeScript
  loader
summary: >-
  Prompty: Arbitrary code execution via JavaScript frontmatter in TypeScript
  loader
severity: high
cwe:
  - CWE-94
vendor: prompty
product: '@prompty/core'
ecosystem: npm
affected:
  - '@prompty/core >= 2.0.0-alpha.1, < 2.0.0-beta.3'
patched:
  - '@prompty/core 2.0.0-beta.3'
published: '2026-07-17'
updated: '2026-07-17'
source: GHSA
sourceUrl: 'https://github.com/advisories/GHSA-c4gh-rv8h-q9vw'
references:
  - url: >-
      https://github.com/microsoft/prompty/security/advisories/GHSA-c4gh-rv8h-q9vw
  - url: 'https://nvd.nist.gov/vuln/detail/CVE-2026-53597'
  - url: >-
      https://github.com/microsoft/prompty/commit/c27402da2487075be577f06aa79df627fb9d6853
  - url: 'https://github.com/advisories/GHSA-c4gh-rv8h-q9vw'
tags:
  - ghsa
  - npm
epss: 0.00972
epssPercentile: 0.60312
ingestedAt: '2026-07-17T20:15:43.265Z'
---

## Overview

## Summary
The TypeScript Prompty loader used `gray-matter` without overriding executable frontmatter engines. `gray-matter` supports JavaScript frontmatter blocks such as `---js` and evaluates them while parsing. An attacker-controlled `.prompty` file could therefore execute arbitrary JavaScript during prompt loading.

## Affected package
- npm `@prompty/core` v2 prerelease line: `>= 2.0.0-alpha.1 < 2.0.0-beta.3`
- Fixed in `@prompty/core@2.0.0-beta.3`

The legacy v1 JavaScript runtime had a historical hardening change for this issue. During the v2 TypeScript runtime rebuild, the loader again called `gray-matter` directly and the vulnerable behavior was present in the v2 prerelease packages until `2.0.0-beta.3`.

## Impact
Applications that load untrusted `.prompty` files, user-provided prompt paths, or prompt bundles from less-trusted locations could execute arbitrary JavaScript in the host Node.js process during frontmatter parsing.

## Remediation
Upgrade `@prompty/core` to `2.0.0-beta.3` or later.

The fix explicitly overrides the `js` and `javascript` gray-matter engines and rejects JavaScript frontmatter in `.prompty` files. Prompty frontmatter is YAML-only; executable frontmatter is unsupported. A regression test now verifies that `---js` frontmatter is rejected and not evaluated.

## Fix details
Fixed by commit `c27402da2487075be577f06aa79df627fb9d6853` and released via `typescript/2.0.0-beta.3`.

## Affected packages

- `@prompty/core >= 2.0.0-alpha.1, < 2.0.0-beta.3`

## Remediation

Upgrade to a patched release:

- `@prompty/core 2.0.0-beta.3`