CVE-2026-53598: 
JavaScript vulnerability analysis and mitigation

CVE-2026-53598 is a path traversal vulnerability in Microsoft's Prompty, a markdown-based file format (.prompty) for LLM prompts. The flaw allows Prompty loaders to expand ${file:...} references in .prompty frontmatter without enforcing that resolved paths remain within the prompt directory or allowed roots, enabling arbitrary local file reads. It affects all Prompty packages across ecosystems prior to version 2.0.0-beta.2: PyPI prompty (≤ 2.0.0b1), npm @prompty/core (≤ 2.0.0-beta.1), crates.io prompty (≤ 2.0.0-beta.1), and NuGet Prompty.Core (≤ 2.0.0-beta.1). The advisory was first published on June 6, 2026, and assigned a CVE on July 16, 2026. It carries a CVSS v3.1 base score of 7.5 (High) (Github Advisory, Prompty Advisory).

The root cause is improper path validation (CWE-22: Path Traversal; CWE-200: Exposure of Sensitive Information) in the Prompty file loader's ${file:...} reference expansion logic. When processing .prompty frontmatter, the loader resolved file references using Path.GetFullPath(Path.Combine(parentDir, relativePath)) without subsequently verifying that the resolved path remained within the prompt file's directory tree. An attacker-controlled .prompty file could supply ${file:../../../etc/passwd} (directory traversal), ${file:/etc/passwd} (absolute path), or a symlink pointing outside the allowed directory to cause the host application to read arbitrary files accessible to the process. The fix, introduced in commit 88ac9948d7d37995edbb2f6d36913436626c39e1, canonicalizes both the target path and allowed roots (resolving symlinks via ResolveLinkTarget), then rejects any reference whose canonical path does not fall within an allowed root (Prompty Advisory, Fix Commit).

Successful exploitation results in high confidentiality impact: an unauthenticated network attacker can read arbitrary local files accessible to the application process by supplying a malicious .prompty file. Sensitive data at risk includes configuration files, credentials, API keys, environment files, and any other files readable by the process account. There is no integrity or availability impact, but disclosed credentials or secrets could enable lateral movement or privilege escalation in downstream systems (Github Advisory, Prompty Advisory).

1. Identify a target application: Find an application that uses a vulnerable Prompty runtime (PyPI prompty ≤ 2.0.0b1, npm @prompty/core ≤ 2.0.0-beta.1, crates.io prompty ≤ 2.0.0-beta.1, or NuGet Prompty.Core ≤ 2.0.0-beta.1) and accepts user-supplied or remotely sourced .prompty files.
2. Craft a malicious .prompty file: Create a .prompty file with a ${file:...} reference in the YAML frontmatter that points outside the prompt directory, for example:

---
name: malicious
description: "${file:../../../etc/passwd}"
---
Hello

Alternatively, use an absolute path (${file:/etc/shadow}) or a symlink within the prompt directory pointing to a sensitive file outside it. 3. Deliver the malicious prompt file: Submit the crafted .prompty file to the target application through any available input channel — file upload, API endpoint, prompt bundle, or shared prompt repository. 4. Trigger file loading: Cause the application to load and process the malicious .prompty file, which invokes the Prompty loader's ${file:...} expansion logic. 5. Exfiltrate the disclosed content: Observe the application's response, logs, or output for the expanded file content. If the application returns or logs frontmatter values, the contents of the targeted local file will be exposed to the attacker (Prompty Advisory, Fix Commit).

• File System: Presence of .prompty files in application directories containing ${file:../, ${file:/, or symlinks within the prompt directory pointing to files outside it.
• Logs: Application logs showing frontmatter values that contain contents of system files (e.g., /etc/passwd entries, credential strings, or configuration data) where prompt descriptions or metadata fields are logged.
• Logs: Errors referencing outside allowed roots in patched versions, which may indicate attempted exploitation against an upgraded system.
• Process: Unexpected file read operations by the application process on sensitive paths (e.g., /etc/passwd, /etc/shadow, .env files, credential stores) observable via file access auditing (e.g., Linux auditd with -w /etc/passwd -p r).
• Network: Outbound data transfers from the application server following ingestion of externally sourced .prompty files, potentially indicating exfiltration of disclosed file contents.

Upgrade to the patched version for your ecosystem: PyPI prompty ≥ 2.0.0b2, npm @prompty/core ≥ 2.0.0-beta.2, crates.io prompty ≥ 2.0.0-beta.2, or NuGet Prompty.Core ≥ 2.0.0-beta.2. The patch enforces that ${file:...} references resolve only within the .prompty file's directory tree by default; host applications requiring access to shared assets outside that tree must explicitly configure AllowedFileRoots via runtime load options. As a workaround until patching is possible, restrict the application to loading .prompty files only from trusted, controlled sources and apply OS-level file permissions to limit the process account's read access to sensitive files (Github Advisory, Fix Commit).