CyberRota Analysis
AI-GeneratedThe vulnerability affects the Prompty markdown file format in versions 2.0.0-alpha.1 to 2.0.0-beta.3, where the TypeScript loader improperly handles executable JavaScript in frontmatter, enabling the execution of arbitrary JavaScript from attacker-controlled .prompty files. This can lead to potential remote code execution during prompt loading, posing significant risks to applications utilizing this format. Developers and organizations using affected versions should prioritize upgrading to version 2.0.0-beta.3 to mitigate this security risk.
Public Exploit Signal
A public exploit, PoC, GitHub repository or Metasploit reference was detected for this CVE.
Note: these links are listed for security research and verification purposes only.
Original NVD Description
Prompty is a markdown file format (.prompty) for LLM prompts. From 2.0.0-alpha.1 until 2.0.0-beta.3, the @prompty/core TypeScript loader in runtime/typescript/packages/core/src/core/loader.ts used gray-matter without overriding executable js and javascript frontmatter engines, allowing an attacker-controlled .prompty file with ---js frontmatter to execute arbitrary JavaScript during prompt loading. This issue is fixed in version 2.0.0-beta.3.