External risk intelligence

Prompty Template Injection Allows JavaScript Execution

CVE advisorySeverity: CRITICAL (CVSS 10.0)

CVE-2026-73299

Prompty is a development tool/library for managing LLM prompts. While the vulnerability occurs during the processing of untrusted templates, which could occur in a public-facing application, the library itself is typically integrated into development or backend workflows rather than being a standalone, internet-facing service by design.

Code Injection

Halo Surface Signal: 3 out of 5 — possibly public-facing.

External exposure likelihood

Horizon Alert

Summary of the vulnerability and why it matters

This advisory concerns a vulnerability in the Prompty markdown file format rendering. The issue arises when untrusted template bodies are processed, potentially allowing for the execution of malicious JavaScript code within the host Node.js environment. The primary concern is to confirm if this technology is used and if there is any exposure.

Vulnerability allows untrusted code execution.
Affects developers using specific prompt templates.
Confirm usage and assess exposure to this risk.

Attack Path

How an attacker could exploit the issue

An attacker could target systems using Prompty by tricking them into processing a malicious `.prompty` template. This template, when rendered by the Nunjucks template engine, allows the attacker to exploit JavaScript member access to navigate object constructors and prototypes. This ultimately enables the execution of arbitrary JavaScript code within the host Node.js environment, potentially leading to full system compromise.

No authentication or user interaction needed.
Malicious `.prompty` template processing.
Remote code execution on host.

Live Threat

Current exploitation, exposure, and threat context

When untrusted .prompty template bodies are processed, unrestricted JavaScript member access could allow an attacker-controlled template to execute arbitrary JavaScript in the host Node.js process by traversing constructor and prototype properties. This could affect system data and service behavior when the renderer is configured to process such templates.

Node.js process and system data.
Untrusted template processing.
Arbitrary JavaScript execution.

Operational Fix

Recommended remediation, mitigation, and detection steps

The Prompty renderer's unrestricted JavaScript member access, allowing remote code execution via crafted templates, necessitates action from development and platform teams. The initial focus should be on identifying all instances of the affected technology, assessing their exposure and criticality, and then assigning ownership for remediation planning.

Own the issue: Development or Platform Teams.
Verify first: Template processing exposure and criticality.
Action: Plan vendor coordination and updates.

Supplementary metadata

CVSS vector

Validate whether this threat affects your internet-facing exposure.

Halo Threat Intelligence helps prioritize remediation with Halo Surface Signal and H/A/L/O context. Start exposure validation with a free external attack surface trial.

Free EASM Trial See How Signal Works

Frequently asked questions

What is Prompty and how is it used?

Prompty is a file format and development tool used to manage LLM prompts as markdown files. Developers use it to standardize and structure how prompts are defined and processed within their applications. It serves as a bridge between prompt engineering and the backend code that executes these prompts.

What does CVE-2026-73299 mean for Prompty?

This vulnerability is classified as Improper Neutralization of Input (CWE-94) and Improper Neutralization of Special Elements Used in a Template Engine (CWE-1336). In simple terms, the software's template renderer was too permissive, allowing it to interpret parts of a prompt as executable commands rather than plain text, potentially giving an attacker control over the system.

How can an attacker trigger this vulnerability?

An attacker triggers this by providing a malicious .prompty file that the application processes. The renderer mistakenly executes JavaScript hidden within the template by navigating through object properties. This flaw is specifically tied to the processing of untrusted templates; simply having the Prompty library installed or using it with trusted, internal templates does not trigger the bug.

Is my application at risk according to Halo Surface Signal?

Halo Surface Signal notes that Prompty is typically used in backend or development workflows, not as a standalone, internet-facing service. However, if your application is configured to accept and render .prompty files from untrusted external users, the risk increases. You should check if your software exposes this template rendering functionality to external input.

How do I fix this vulnerability in my projects?

The primary step is to update your project's Prompty dependency to the secure versions: 0.1.5 or 2.0.0-beta.5. Development teams should prioritize auditing their codebase to identify where untrusted .prompty files might be processed and verify that the updated versions are implemented to restrict the template renderer's access.

References

Written by Nicholas Merritt

Nicholas Merritt is VP of Security Solutions at Halo Security. With more than 25 years across application security, vulnerability prioritization, and offensive security, he helps teams translate threat data into practical exposure validation and remediation focus. He authors Halo Threat Intelligence CVE advisories using Halo Surface Signal and H/A/L/O context to prioritize internet-facing risk.