What happened
NVD published CVE-2026-73299 (CVSS 10.0, Critical) on 2026-08-12: prior to the fixed versions, Prompty's TypeScript Nunjucks renderer evaluated untrusted .prompty template bodies with unrestricted JavaScript member access, allowing an attacker-controlled template to traverse constructor/prototype properties and escape the template sandbox.
Why it matters
Prompty is Microsoft's markdown-based format for defining and sharing LLM prompts across tooling (VS Code extension, LangChain/Semantic Kernel integrations). A maximum-severity RCE in the template engine means any pipeline that loads externally-sourced or user-contributed prompt templates (a common pattern for prompt marketplaces/sharing) can be fully compromised.
Attack vector
An attacker-controlled .prompty template (e.g., a prompt template shared/loaded from an untrusted source or user-supplied content) traverses JavaScript constructor and prototype properties during template rendering, escaping the intended template sandbox and gaining unrestricted JS member access — enabling arbitrary code execution in the host Node/TS process.
Affected systems
Microsoft Prompty (npm/TS package) prior to 0.1.5 and 2.0.0-beta.5
Mitigation
Upgrade to Prompty >=0.1.5 (1.x line) or >=2.0.0-beta.5. Avoid rendering untrusted .prompty templates without sandboxing.