Critical RCE Flaw Patched in Prompty Core

The @prompty/core package contains a critical vulnerability, identified as GHSA-w28w-gp39-m4p6, that permits remote code execution. By exploiting a flaw in the Nunjucks renderer, an attacker can manipulate template bodies to execute unauthorized JavaScript within the host Node.js process.

This vulnerability is rated with a CVSS score of 10.0, the highest possible severity, due to the complete compromise of the host environment it enables. The issue affects all versions of @prompty/core up to and including 0.1.4, as well as versions up to 2.0.0-beta.4.

What's at Risk

Any application utilizing the TypeScript runtime to process untrusted or externally sourced .prompty files is at risk. This includes systems that ingest community-supplied templates, cloned repositories, or content generated by large language models.

Organizations deploying these components in internet-facing services are particularly exposed, as the renderer acts as a gateway for processing potentially malicious input. When these templates are handled with the privileges of the host process, an attacker who successfully injects code gains the ability to interact with the underlying server environment as if they were a local user.

How the Flaw Works

This vulnerability is a form of Server-Side Template Injection (SSTI). In general, SSTI occurs when an application embeds user-provided input directly into a template engine rather than treating it as data. Template engines are designed to parse and execute logic, such as variable interpolation or conditional statements, to build dynamic content.

When an engine is improperly configured, an attacker can supply malicious syntax that forces the renderer to interact with internal object structures. By traversing constructor and prototype properties, the attacker can break out of the intended sandbox, escaping the application's constraints to execute arbitrary functions or system commands. This class of flaw effectively turns a data-processing feature into a remote execution vector, bypassing standard security boundaries.

How to Protect Your Systems

• Upgrade immediately to @prompty/core version 2.0.0-beta.5 or later to receive the necessary security patches.
• Review all application logic that processes .prompty files to ensure that input sources are strictly validated and trusted.
• Implement the principle of least privilege by running the Node.js host process with the minimum permissions required for its function.
• Monitor server logs for unusual execution patterns or attempts to access restricted object properties within template rendering tasks.
• Ensure that any dependencies used for parsing or rendering templates are kept up to date through automated dependency management workflows.

Given the critical severity of this flaw and the potential for full system compromise, patching is the only effective defense. The updated renderer explicitly blocks dangerous member traversal and restricts function calls, effectively neutralizing the attack vector by enforcing a strict own-data-only policy for all inputs.