npm · @prompty/core
Prompty: Server-Side Template Injection to Remote Code Execution in the @prompty/core Nunjucks Renderer
The TypeScript Nunjucks renderer evaluated untrusted .prompty template bodies with unrestricted JavaScript member access. An attacker-controlled template could traverse constructor and prototype properties to execute JavaScript in the host Node.js process.
@prompty/core versions <= 0.1.4@prompty/core versions <= 2.0.0-beta.4Applications that render untrusted, community-supplied, cloned, or LLM-generated .prompty files with the TypeScript runtime could allow attacker-controlled code execution with the privileges of the Node.js host process.
Upgrade to @prompty/core 2.0.0-beta.5 or later. The patched renderer sanitizes render inputs to own-data-only values, rejects constructor/prototype member traversal, and disallows template function calls. Ordinary interpolation, conditionals, loops, and own nested data properties remain supported.
The fix is merged in PR #404 and includes regression coverage for default Nunjucks rendering, explicit renderer usage, unsafe member lookups, and attempted template function calls.
Is your project exposed to this? Stateward checks every dependency on every pull request and flags it only if your code actually reaches it.
Check my repoSources: CISA KEV (public domain), OSV.dev & GitHub Advisory Database (CC-BY-4.0), FIRST EPSS, NVD/CWE (public domain). Served live from the Stateward advisory database.