CVE-2026-53598 Prompty: Arbitrary File Read via ${file:path} Reference Expansion

What is CVE-2026-53598?

CVE-2026-53598 is a high-severity path traversal vulnerability in microsoft prompty, published on 16 Jul 2026. An attacker can exploit it over the internet without logging in, with no action from the victim.

Official description

Prompty is a markdown file format (.prompty) for LLM prompts. Prior to 2.0.0-beta.2, Prompty loaders expanded ${file:...} references in .prompty frontmatter without enforcing that resolved paths stayed within the prompt directory or allowed roots, allowing an attacker-controlled prompt file to read local files through absolute paths, .. traversal, or symlink escapes. This issue is fixed in versions 2.0.0-beta.2.

Weakness: CWE-22, CWE-200

Which versions are affected by CVE-2026-53598?

9 open source packages ship an affected version, including prompty, Prompty.Core and @prompty/core.

How do I fix CVE-2026-53598?

Upgrade prompty to a fixed version for your release line: 2.0.0b2 or 2.0.0-beta.2.

Upgrade, and resolve every user-supplied path against an allowed base folder before opening it. More about Path traversal.

Is CVE-2026-53598 being exploited?

There is no known exploitation of CVE-2026-53598 in the wild and no public exploit code.

Sources

• CVE record
• NVD
• OSV
• GitHub advisory
• How this page is made

Also known as GHSA-wxhm-2mq7-7697, PYSEC-2026-3538.