CVE-2026-53598High· 7.5▾ TwilightPrompty: Arbitrary file read via file reference expansion
▾ Twilight zone — High severity, or a signal on a lesser flaw
impact 41.3 · likelihood 0.3 · exploitation 0
Need a working PoC? Pro members can cast a request and our team develops one — it lands right here.
Exploit-prediction probability, daily snapshots since Jul 17.
Disclosure to exploitation, from the record and what we observed since indexing it.
Disclosed via GHSA
1.1%
1.1% → 1.3%
Prompty loaders expanded ${file:...} references in .prompty frontmatter without enforcing that the resolved path stayed within an authorized directory. An attacker-controlled prompt file could use path traversal or an absolute path to cause the host application to read files accessible to the process.
prompty versions <= 2.0.0b1; fixed in 2.0.0b2@prompty/core versions <= 2.0.0-beta.1; fixed in 2.0.0-beta.2prompty versions <= 2.0.0-beta.1; fixed in 2.0.0-beta.2Prompty.Core versions <= 2.0.0-beta.1; fixed in 2.0.0-beta.2Applications that load untrusted .prompty files, user-provided prompt paths, or prompt bundles from less-trusted locations could disclose local files available to the application process when expanded values are logged, returned, or otherwise exposed.
Upgrade to the fixed runtime version for your ecosystem. The fix makes file references secure by default: ${file:...} may only resolve within the directory tree containing the .prompty file. Host applications that need shared prompt assets outside that tree must explicitly provide allowed file roots through runtime load options. Absolute paths, .. traversal, and symlink escapes outside allowed roots are rejected.
The patched runtimes canonicalize file-reference targets and allowed roots before reading referenced files, reject targets outside the prompt directory by default, and add regression coverage for traversal, absolute paths, explicit allowlists, and symlink escapes. The release commit is 88ac9948d7d37995edbb2f6d36913436626c39e1.
prompty <= 2.0.0b1@prompty/core <= 2.0.0-beta.1prompty <= 2.0.0-beta.1Prompty.Core <= 2.0.0-beta.1Upgrade to a patched release:
prompty 2.0.0b2@prompty/core 2.0.0-beta.2prompty 2.0.0-beta.2Prompty.Core 2.0.0-beta.2Connected by shared product, vendor, weakness, or advisory.
CVE-2026-73299Critical· 10.0Prompty is a markdown file format (.prompty) for LLM prompts
CVE-2021-25122High· 7.5When responding to new h2c connection requests, Apache Tomcat versions 10.0.0-M1 to 10.0.0, 9.0.0.M1 to 9.0.41 and 8.5.0 to 8.5.61 could duplicate request headers and a limited amount of request body from one request to another meaning u…
CVE-2022-31746Medium· 6.5Internal URLs are protected by a secret UUID key, which could have been leaked to web page through the Referrer header
CVE-2026-45623High· 7.5postcss: PostCSS: Information disclosure and denial of service via crafted CSS input (CVE-2026-45623)
CVE-2026-47735HighArc is an open, SQL-native time-series database for telemetry
CVE-2026-49742HighTYPO3 CMS has Broken Access Control in its Media Module