CVE-2026-53598

Name of the Vulnerable Software and Affected Versions Prompty versions prior to 2.0.0-beta.2

Description Prompty loaders fail to properly validate the resolution of ${file:...} references within .prompty frontmatter. This lack of enforcement allows the resolution of paths outside the intended prompt directory or allowed roots, enabling an attacker to read local files using absolute paths, directory traversal (using ..), or symlink escapes.

Recommendations Update to version 2.0.0-beta.2.