PT-2026-60484 · Npm · @Prompty/Core

CVE-2026-53597

·

Published

2026-07-16

·

Updated

2026-07-17

CVSS v4.0

8.7

High

VectorAV:N/AC:L/AT:N/PR:N/UI:P/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N
Name of the Vulnerable Software and Affected Versions @prompty/core versions 2.0.0-alpha.1 through 2.0.0-beta.2
Description The @prompty/core TypeScript loader in runtime/typescript/packages/core/src/core/loader.ts uses gray-matter without overriding executable js and javascript frontmatter engines. This allows an attacker to use a crafted .prompty file containing ---js frontmatter to execute arbitrary JavaScript during the prompt loading process.
Recommendations Update to version 2.0.0-beta.3.

Exploit

Fix

Code Injection

Found an issue in the description? Have something to add? Feel free to write us 👾
dbugs@ptsecurity.com

Weakness Enumeration

CWE-94

Related Identifiers

CVE-2026-53597
GHSA-C4GH-RV8H-Q9VW

Affected Products

@Prompty/Core