p PatchFirst

CVE-2026-53598

CVE-2026-53598 · Prompty: Arbitrary File Read via ${file:path} Reference Expansion

This page contains facts from public vulnerability sources. Check the original advisory before updating.

Prompty is a markdown file format (.prompty) for LLM prompts. Prior to 2.0.0-beta.2, Prompty loaders expanded ${file:...} references in .prompty frontmatter without enforcing that resolved paths stayed within the prompt directory or allowed roots, allowing an attacker-controlled prompt file to read local files through absolute paths, .. traversal, or symlink escapes. This issue is fixed in versions 2.0.0-beta.2.

CVSS 7.5 · High · EPSS 1.3% · Fix available

Published
Updated

Stack: python · node

Affected products and versions

  • prompty

    Versions
    • < 2.0.0-beta.2: Affected

    No fix published

  • prompty PyPI

    Versions
    • 0.1.1
    • 0.1.10
    • 0.1.12
    • 0.1.13
    • 0.1.14
    • 0.1.15
    • 0.1.16
    • 0.1.17
    • 0.1.18
    • 0.1.19
    • 0.1.20
    • 0.1.21
    • 0.1.22
    • 0.1.23
    • 0.1.24
    • 0.1.33
    • 0.1.34
    • 0.1.36
    • 0.1.37
    • 0.1.38
    • 0.1.39
    • 0.1.40
    • 0.1.44
    • 0.1.45
    • 0.1.46
    • 0.1.47
    • 0.1.48
    • 0.1.49
    • 0.1.50
    • 0.1.7
    • 0.1.8
    • 0.1.9
    • 1.0.0a1
    • 1.0.0a2
    • 1.0.0b1
    • 1.0.0b2
    • 1.0.0b3
    • 2.0.0a1
    • 2.0.0a2
    • 2.0.0a3
    • 2.0.0a4
    • 2.0.0a5
    • 2.0.0a6
    • 2.0.0a7
    • 2.0.0a8
    • 2.0.0a9
    • 2.0.0b1
    Affected ranges
    • ECOSYSTEM: < 2.0.0b2

    Update to 2.0.0b2

  • @prompty/core npm

    Affected ranges
    • SEMVER: < 2.0.0-beta.2

    Update to 2.0.0-beta.2

  • prompty crates.io

    Affected ranges
    • SEMVER: < 2.0.0-beta.2

    Update to 2.0.0-beta.2

  • prompty.core NuGet

    Versions
    • 0.2.3-beta
    Affected ranges
    • ECOSYSTEM: < 2.0.0-beta.2

    Update to 2.0.0-beta.2

Original sources

Check your server →