Prompty: Server-Side Template Injection to Remote Code Execution in the @prompty/core Nunjucks Renderer
- Product
- @prompty/core
- Affected
- @prompty/core <= 0.1.4 and >= 2.0.0-alpha.1, <= 2.0.0-beta.4
- Fixed in
- 0.1.5
Last verified against sources: October 26, 2026
Am I affected?
@prompty/core: affected @prompty/core <= 0.1.4 and >= 2.0.0-alpha.1, <= 2.0.0-beta.4. Fixed in 0.1.5.
- Check your version: run
npm ls @prompty/core. Versions <= 0.1.4 of @prompty/core are affected. [1]
What to do now
- Upgrade to the fixed version: run
npm install @prompty/core@0.1.5(first patched version 0.1.5). [1] - Upgrade to
@prompty/core2.0.0-beta.5or later. [1]
General practice, not from the source: if the affected software could read tokens or credentials, rotate them after upgrading; pin versions and review changes before updating tools your agents run.
What happened
Impact
- Applications that render untrusted, community-supplied, cloned, or LLM-generated
.promptyfiles with the TypeScript runtime could allow attacker-controlled code execution with the privileges of the Node.js host process. [1]
What was done
- Upgrade to
@prompty/core2.0.0-beta.5or later. [1] - The patched renderer sanitizes render inputs to own-data-only values, rejects constructor/prototype member traversal, and disallows template function calls. [1]
- The fix is merged in PR #404 and includes regression coverage for default Nunjucks rendering, explicit renderer usage, unsafe member lookups, and attempted template function calls. [1]
- npm/@prompty/core affected >= 2.0.0-alpha.1, <= 2.0.0-beta.4 patched 2.0.0-beta.5 [1]
Sources
- GHSA-w28w-gp39-m4p6 — GitHub Advisory Database
Every statement above was checked against these sources before publishing. Spotted an error? Tell us and we will correct it with a dated note.
Share advisory brief with your team
Copy a plain-text summary for Slack, GitHub issues, or team security channels.
Prompty: Server-Side Template Injection to Remote Code Execution in the @prompty/core Nunjucks Renderer
Product: @prompty/core | Affected: @prompty/core <= 0.1.4 and >= 2.0.0-alpha.1, <= 2.0.0-beta.4 | Fixed in: 0.1.5
Summary: The TypeScript Nunjucks renderer evaluated untrusted `.prompty` template bodies with unrestricted JavaScript member access.
Source & remediation on AgentArmorHQ: https://agentarmorhq.com/incidents/2026/07/ghsa-w28w-gp39-m4p6-prompty-coreCorrections
Report an error or request a correction. We review requests within 5 business days and add a dated correction note.
Discussions for @prompty/core
Ask questions or share configuration tips. Governed by our Community Rules & Terms.
No posts match this filter yet.
Be the first to ask a question or share a working tip.