Prompty: Arbitrary file read via file reference expansion

Exploitation

No confirmed exploitation recorded. Patch Next marks exploitation only from CISA KEV.

CVSS

7.5 · CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

EPSS

• CVE-2026-53598: 1.29% estimated exploitation activity in the next 30 days; percentile 70.19 (FIRST EPSS, 2026-11-03). This is a model estimate, not proof of exploitation or customer exposure.

As published by the source; long descriptions are shortened.

Summary Prompty loaders expanded ${file:...} references in .prompty frontmatter without enforcing that the resolved path stayed within an authorized directory. An attacker-controlled prompt file could use path traversal or an absolute path to cause the host application to read files accessible to the process. Affected packages - PyPI prompty versions <= 2.0.0b1; fixed in 2.0.0b2 - npm @prompty/core versions <= 2.0.0-beta.1; fixed in 2.0.0-beta.2 - crates.io prompty versions <= 2.0.0-beta.1; fixed in 2.0.0-beta.2 - NuGet Prompty.Core versions <= 2.0.0-beta.1; fixed in 2.0.0-beta.2 Impact Applications that load untrusted .prompty files, user-provided prompt paths, or prompt bundles from less-trusted locations could disclose local files available to the application process when expanded values are logged, returned, or otherwise exposed. Remediation Upgrade to the fixed runtime version for your ecosystem. The fix makes file references secure by default: ${file:...} may only resolve…

Published by the source

17 Jul 2026, 19:46 UTC

Last modified by the source

3 Aug 2026, 12:38 UTC

Source last checked

26 Oct 2026, 13:00 UTC

1. Revision 2 · amended · 26 Oct 2026

   Amended from ghsa record GHSA-wxhm-2mq7-7697

2. Revision 1 · created · 24 Oct 2026

   Published from osv record GHSA-wxhm-2mq7-7697

Preview the exact text before you copy it. Commands are read-only suggestions; review them before running anything.

# Patch Next advisory brief: CVE-2026-53598

Advisory: Prompty: Arbitrary file read via file reference expansion
IDs: CVE-2026-53598, GHSA-wxhm-2mq7-7697
Record: https://patchnext.com/advisories/cve-2026-53598 (revision 2, source checked 26 Oct 2026, 13:00 UTC)
Inventory: none attached. This brief comes from a public page and does not say whether any deployment is affected.
Severity: High (CVSS 7.5)
Exploitation: no confirmed exploitation recorded. Patch Next confirms exploitation only from CISA KEV.
Vendor response: Vendor fix available; fixed versions by package: prompty.core 2.0.0-beta.2; prompty 2.0.0b2; prompty 2.0.0-beta.2; @prompty/core 2.0.0-beta.2. A vendor fix does not mean a deployment is fixed.

## Affected components
- NuGet prompty.core: affected <= 2.0.0-beta.1; fixed in 2.0.0-beta.2
- PyPI prompty: affected <= 2.0.0b1; fixed in 2.0.0b2
- crates.io prompty: affected <= 2.0.0-beta.1; fixed in 2.0.0-beta.2
- npm @prompty/core: affected <= 2.0.0-beta.1; fixed in 2.0.0-beta.2

## Suggested inspection (read-only)
- NuGet prompty.core: check the installed version with your package manager.
- `python -m pip show prompty`: prints the installed version. Run with the environment that serves production active.
- crates.io prompty: check the installed version with your package manager.
- `npm ls @prompty/core --all`: lists every installed copy and version, including transitive ones. Run in the project root after `npm ci`.

## Supported action
Upgrade each affected component to a fixed version on its release line. For a transitive dependency, upgrade the parent package or add an override or constraint, then regenerate the lockfile. Redeploy every environment that ran an affected version.

## Required regression checks
- Run the test suite and a production build.
- Exercise the features that depend on prompty.core, prompty, @prompty/core.
- Repeat the inspection and confirm that only fixed versions remain installed.

## Rollback considerations
- Keep the previous lockfile and deployment artifact. Rolling back reinstates the vulnerable version, so apply any documented mitigation while you fix forward.

## Unresolved questions
- Which deployments run an affected version?
- Exploitation status can change. Check again before lowering the priority.
- Mark the work resolved only after the fixed version is verified in production.

## Sources
- Verified: https://osv.dev/vulnerability/GHSA-wxhm-2mq7-7697 (OSV record GHSA-wxhm-2mq7-7697 lists affected ranges: PyPI prompty >=0 =0 =0 =0 <2.0.0-beta.2 (fixed))
- Verified: https://github.com/advisories/GHSA-wxhm-2mq7-7697 (GitHub-reviewed advisory GHSA-wxhm-2mq7-7697 lists affected ranges: PyPI prompty >=0 =0 =0 =0 <=2.0.0-beta.1)

Commands are suggestions: review each one before running it.