Vulnerability  ·  2026-08-13

Prompty (Microsoft) template renderer allows sandbox escape via Nunjucks prototype/constructor traversal — CVSS 10.0

VulnerabilityHigh impactGlobalCVE-2026-73299
NVD published CVE-2026-73299 (CVSS 10.0, Critical) on 2026-08-12: prior to the fixed versions, Prompty's TypeScript Nunjucks renderer evaluated untrusted .prompty template bodies with unrestricted JavaScript member access, allowing an attacker-controlled template to traverse constructor/prototype properties and escape the template sandbox.
Prompty is Microsoft's markdown-based format for defining and sharing LLM prompts across tooling (VS Code extension, LangChain/Semantic Kernel integrations). A maximum-severity RCE in the template engine means any pipeline that loads externally-sourced or user-contributed prompt templates (a common pattern for prompt marketplaces/sharing) can be fully compromised.
An attacker-controlled .prompty template (e.g., a prompt template shared/loaded from an untrusted source or user-supplied content) traverses JavaScript constructor and prototype properties during template rendering, escaping the intended template sandbox and gaining unrestricted JS member access — enabling arbitrary code execution in the host Node/TS process.
Microsoft Prompty (npm/TS package) prior to 0.1.5 and 2.0.0-beta.5
Upgrade to Prompty >=0.1.5 (1.x line) or >=2.0.0-beta.5. Avoid rendering untrusted .prompty templates without sandboxing.
NVD - CVE-2026-73299
See this in the live feed Explore related AI security and governance findings — updated every morning.
Open the feed →