CVE-2026-73299 Prompty: Server-Side Template Injection to Remote Code Execution in the @prompty/core Nunjucks Renderer
Attackers can execute arbitrary JavaScript in the host Node.js process via malicious Prompty templates due to unsafe Nunjucks rendering.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- None listed
What is CVE-2026-73299?
CVE-2026-73299 is a critical code injection vulnerability in microsoft prompty, published on 12 Aug 2026. An attacker can exploit it over the internet without logging in, with no action from the victim.
Official description
Prompty is a markdown file format (.prompty) for LLM prompts. Prior to 0.1.5 and 2.0.0-beta.5, the TypeScript Nunjucks renderer evaluated untrusted .prompty template bodies with unrestricted JavaScript member access. An attacker-controlled template could traverse constructor and prototype properties to execute JavaScript in the host Node.js process. This issue is fixed in versions 0.1.5 and 2.0.0-beta.5.
Which versions are affected by CVE-2026-73299?
4 open source packages ship an affected version, including @prompty/core.
| Package | Affected | Fixed in |
|---|---|---|
@prompty/core npm | All versions | 0.1.5 |
@prompty/core npm | All versions | 0.1.5 |
@prompty/core npm | From 2.0.0-alpha.1 | 2.0.0-beta.5 |
@prompty/core npm | From 2.0.0-alpha.1 | 2.0.0-beta.5 |
How do I fix CVE-2026-73299?
Upgrade @prompty/core to a fixed version for your release line: 0.1.5 or 2.0.0-beta.5.
Upgrade, and never evaluate templates, expressions or code built from user input. More about Code injection.
Is CVE-2026-73299 being exploited?
There is no known exploitation of CVE-2026-73299 in the wild and no public exploit code.
Sources
Also known as GHSA-w28w-gp39-m4p6.