Prompty (Microsoft) LLM prompt template format: critical server-side template injection RCE via Nunjucks renderer

Prompty is a markdown-based (.prompty) file format for LLM prompts maintained under the Microsoft GitHub organization. Prior to 0.1.5 / 2.0.0-beta.5, the TypeScript Nunjucks renderer evaluated untrusted .prompty template bodies with unrestricted JavaScript member access (CVE-2026-73299, CVSS 10.0, Critical), allowing an attacker-controlled template to traverse constructor and prototype properties to achieve arbitrary code execution.

Prompty templates are designed to be shared and reused across LLM application pipelines; a maximum-severity (CVSS 10.0) server-side template injection in the rendering engine means any application that loads an untrusted or third-party .prompty file — a normal workflow for prompt-sharing ecosystems — can be fully compromised.

Attacker supplies a crafted .prompty template body that, when rendered, traverses JavaScript constructor/prototype chains to escape the templating sandbox and execute arbitrary code

Prompty (microsoft/prompty) < 0.1.5 and < 2.0.0-beta.5

Upgrade to Prompty 0.1.5 / 2.0.0-beta.5 or later