Prompty: Server-Side Template Injection to Remote Code Execution in the @prompty/core Nunjucks Renderer
Summary
The TypeScript Nunjucks renderer evaluated untrusted .prompty template bodies with unrestricted JavaScript member access. An attacker-controlled template could traverse constructor and prototype properties to execute JavaScript in the host Node.js process.
Affected packages
- npm
@prompty/coreversions<= 0.1.4 - npm
@prompty/coreversions<= 2.0.0-beta.4
Impact
Applications that render untrusted, community-supplied, cloned, or LLM-generated .prompty files with the TypeScript runtime could allow attacker-controlled code execution with the privileges of the Node.js host process.
Remediation
Upgrade to @prompty/core 2.0.0-beta.5 or later. The patched renderer sanitizes render inputs to own-data-only values, rejects constructor/prototype member traversal, and disallows template function calls. Ordinary interpolation, conditionals, loops, and own nested data properties remain supported.
Fix details
The fix is merged in PR #404 and includes regression coverage for default Nunjucks rendering, explicit renderer usage, unsafe member lookups, and attempted template function calls.
Affected software
Click a technology to see all vulnerabilities affecting it.
| Platform | Package | Vulnerable versions | Fixed in |
|---|---|---|---|
| npm package | @prompty/core | < 0.1.5, >= 2.0.0-alpha.1, < 2.0.0-beta.5 | 0.1.5, 2.0.0-beta.5 |
References
- CVSS vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H- Weakness (CWE)
CWE-1336, CWE-94- Platform
- npm
- Package
@prompty/core- Disclosed
- 24.07.2026
- Updated
- 11.10.2026 10:22
Sources and licenses
OSV / GitHub Advisory Database - GHSA-w28w-gp39-m4p6 - CC BY 4.0
Vulnerability history: @prompty/core
All published vulnerabilities of this package (npm package), newest first. Shows whether this is a one-off slip or a package that needs watching.
- Total entries
- 3
- First → latest
- 07.2026 07.2026
- Without a fix
- 0
- Exploited in attacks
- 0
Severity breakdown
- Critical 1
- High 2
Disclosures per year
- 2026: 3
-
Prompty: Server-Side Template Injection to Remote Code Execution in the @prompty/core Nunjucks Renderer this entry
Know which vulnerabilities affect your application
With the DockRay integration and software inventory enabled, DockRay checks reported component versions against known vulnerabilities and notifies you about confirmed matches. Coverage depends on the supported technology and available advisory data.