CyberRota Analysis
AI-GeneratedThe vulnerability affects the TypeScript Nunjucks renderer in Prompty, allowing untrusted markdown templates to execute arbitrary JavaScript in the host Node.js process due to unrestricted access to JavaScript member properties. This critical flaw can lead to severe security breaches, including remote code execution, making it imperative for organizations using affected versions to upgrade to 0.1.5 or 2.0.0-beta.5 immediately. Developers and security teams utilizing Prompty should prioritize this update to mitigate potential exploitation risks.
Public Exploit Signal
A public exploit, PoC, GitHub repository or Metasploit reference was detected for this CVE.
Note: these links are listed for security research and verification purposes only.
Original NVD Description
Prompty is a markdown file format (.prompty) for LLM prompts. Prior to 0.1.5 and 2.0.0-beta.5, the TypeScript Nunjucks renderer evaluated untrusted .prompty template bodies with unrestricted JavaScript member access. An attacker-controlled template could traverse constructor and prototype properties to execute JavaScript in the host Node.js process. This issue is fixed in versions 0.1.5 and 2.0.0-beta.5.