GHSA-w28w-gp39-m4p6: Prompty: Server-Side Template Injection to Remote Code Execution in the @prompty/core Nunjucks Renderer

Should you act?

• Only if you depend on one of the packages below, directly or transitively, in a vulnerable version. Check your lockfile with npm audit (or: npm ls <package>).
• No CVE has been assigned, so it will not appear in CVE-based scanners that ignore GitHub advisories. npm audit, pip-audit and Dependabot do read GitHub advisories.

Affected packages

Details

Summary The TypeScript Nunjucks renderer evaluated untrusted .prompty template bodies with unrestricted JavaScript member access. An attacker-controlled template could traverse constructor and prototype properties to execute JavaScript in the host Node.js process.

Affected packages - npm @prompty/core versions

Impact Applications that render untrusted, community-supplied, cloned, or LLM-generated .prompty files with the TypeScript runtime could allow attacker-controlled code execution with the privileges of the Node.js host process.

Remediation Upgrade to @prompty/core 2.0.0-beta.5 or later. The patched renderer sanitizes render inputs to own-data-only values, rejects constructor/prototype member traversal, and disallows template function calls. Ordinary interpolation, conditionals, loops, and own nested data properties remain supported.

Fix details The fix is merged in PR #404 and includes regression coverage for default Nunjucks rendering, explicit renderer usage, unsafe member lookups, and attempted template function calls.

CVSS: 10.0 (v3.1) CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H

Sources and references

1. GitHub Advisory GHSA-w28w-gp39-m4p6 github.com
2. github.com github.com
3. github.com github.com
4. github.com github.com

Critical npm advisories · Today’s Security Digest