Security readout for executives and security teams
Plain-English summary
Prompty can let an attacker-controlled prompt template run JavaScript inside the application’s Node.js process. Successful exploitation could expose secrets, alter data, disrupt services, or compromise connected systems. Risk is highest where users or external systems can supply or modify .prompty template bodies.
Executive priority
Treat exposed deployments as an immediate remediation priority because successful exploitation can compromise confidentiality, integrity, and availability of the host process. Prioritize systems accepting templates from users, repositories, integrations, or other untrusted sources. Internal deployments without such input paths still require prompt inventory and upgrading.
Technical view
Before 0.1.5 and from 2.0.0-alpha.1 through 2.0.0-beta.4, the TypeScript Nunjucks renderer allowed unrestricted JavaScript member access. A malicious template could traverse constructor or prototype properties and execute code in the host Node.js process. The issue is classified as CWE-1336 and CWE-94 with CVSS 3.1 score 10.0.
Likely exposure
Exposure requires an affected Prompty version and a path for attacker-controlled .prompty template bodies to reach the TypeScript Nunjucks renderer. Internet-facing prompt upload, editing, repository ingestion, or automation workflows may increase risk. The supplied sources do not establish deployment prevalence or identify affected downstream applications.
Exploitation context
The CVSS vector describes network-reachable, unauthenticated exploitation requiring no user interaction, but actual reachability depends on how templates enter an application. The bundle marks this CVE as absent from KEV and provides no evidence of active exploitation. Public proof-of-concept availability is not established by the supplied evidence.
Researcher notes
The affected component is the TypeScript Nunjucks renderer in Microsoft Prompty. Listed ranges are below 0.1.5 and 2.0.0-alpha.1 through 2.0.0-beta.4. No CPEs are supplied. The source bundle identifies fixes and relevant pull requests and commits, but does not establish exploit activity, public exploit maturity, or downstream product exposure.
Mitigation direction
- Upgrade stable deployments to 0.1.5 or later.
- Upgrade prerelease 2.x deployments to 2.0.0-beta.5 or later.
- Until upgraded, prevent untrusted parties and automated sources from supplying or modifying .prompty template bodies.
- Rebuild and redeploy affected services after updating resolved dependencies.
Validation and detection
- Inspect manifests, lockfiles, and deployed dependency trees for affected Prompty versions.
- Confirm production resolves 0.1.5, 2.0.0-beta.5, or a later version.
- Trace every workflow that creates, imports, edits, or renders .prompty template bodies.
- Verify access controls prevent untrusted template modification where upgrades are pending.
- Use safe regression tests to confirm constructor and prototype traversal is rejected without executing code.
Public sources used
Generated from the cited source records. This long-tail analysis has not been individually reviewed by a named human.
Conservative CVE-to-ATT&CK context
These mappings and lookup hints may be relevant to the vulnerability behavior, CWE, affected product, or exposure path. Glexia-inferred context is not an official MITRE, ATT&CK, CWE, or CVE Program mapping.
ATT&CK lookup starting points
Use these exact CWE pages and searches to review the Glexia ATT&CK library from this CVE's weakness and description context.
CWE-1336: Exact CWE lookup
Use the exact CWE identifier as the starting point before reviewing related ATT&CK behavior. Open the exact CWE lookup page first, then review the ATT&CK searches from that MITRE weakness context. This is a Glexia lookup hint, not an official ATT&CK mapping.
Open ATT&CK lookupCWE-94: Code execution behavior lookup
Code execution and unsafe deserialization weaknesses often justify reviewing execution behavior and process telemetry. Open the exact CWE lookup page first, then review the ATT&CK searches from that MITRE weakness context. This is a Glexia lookup hint, not an official ATT&CK mapping.
Open ATT&CK lookupExecution behavior lookup
The CVE wording references code or command execution, so execution technique review may help defensive triage. This is a Glexia inferred lookup path, not an official MITRE, ATT&CK, or CVE Program mapping.
Open ATT&CK lookupCVE-2026-73299 mapping review
Open the CVE-to-ATT&CK bridge for reviewed, inferred, or future official mappings tied to this CVE.
Open ATT&CK lookup- Severity
- Critical
- CVSS
- 10 (3.1)
- Known Exploited
- No
- Published
Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H
CNA and ADP enrichment extracted from CVE v5
These fields come from the CVE record and ADP containers, not from Glexia's Take. They preserve time-varying source decisions such as CISA SSVC, KEV status, CVSS metrics, and provider references.
SSVC decision data
CVSS vector scores
1 official scoreWe collect every scored CVSS vector available in the official CNA and ADP containers. When more than one version is present, the table keeps the source vectors side by side instead of collapsing them into the highest score.
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H3.96GitHub_MVulnerability scoring details
Base CVSS 3.1 score
10CriticalVector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H
Vulnerability timeline
Timeline events are normalized from CVE metadata, CNA source timelines, ADP timelines, and KEV metadata when present.
- CVE reservedCVE Program
The CVE ID was reserved by the assigning CNA.
- CVE publishedCVE Program
The CVE record was published.
- CVE updatedCVE Program
The CVE record metadata indicates this as the latest update time.
ADP provider summaries
Source materials
- CVE List V5 sourceCVE List V5
- https://github.com/microsoft/prompty/security/advisories/GHSA-w28w-gp39-m4p6CVE reference, GitHub_M · x_refsource_CONFIRM
- https://github.com/microsoft/prompty/pull/404CVE reference, GitHub_M · x_refsource_MISC
- https://github.com/microsoft/prompty/pull/405CVE reference, GitHub_M · x_refsource_MISC
- https://github.com/microsoft/prompty/commit/e4a0ebf49e3a78d5d7796c8480bf9a4f0c54d19eCVE reference, GitHub_M · x_refsource_MISC
- https://github.com/microsoft/prompty/commit/f5c57c94a0990cca79d095c3daab661b4b1fb89fCVE reference, GitHub_M · x_refsource_MISC
- https://github.com/microsoft/prompty/tree/typescript/2.0.0-beta.5CVE reference, GitHub_M · x_refsource_MISC
Products and packages named in the record
CWE details
CWE links open Glexia weakness intelligence pages with official CWE context, developer remediation guidance, and related CVE mappings.
Improper Neutralization of Special Elements Used in a Template Engine
Improper Neutralization of Special Elements Used in a Template Engine represents a recurring weakness pattern that can create exploitable paths when design, validation, or implementation controls are missing.
Improper Control of Generation of Code ('Code Injection')
Improper Control of Generation of Code ('Code Injection') represents a recurring weakness pattern that can create exploitable paths when design, validation, or implementation controls are missing.