CVE-2026-53597 Prompty: Arbitrary code execution via JavaScript frontmatter in TypeScript loader

Prompty is a markdown file format .prompty for LLM prompts. From 2.0.0-alpha.1 until 2.0.0-beta.3, the @prompty/core TypeScript loader in runtime/typescript/packages/core/src/core/loader.ts used gray-matter without overriding executable js and javascript frontmatter engines, allowing an...

PT-2026-60484

Name of the Vulnerable Software and Affected Versions @prompty/core versions 2.0.0-alpha.1 through 2.0.0-beta.2 Description The @prompty/core TypeScript loader in runtime/typescript/packages/core/src/core/loader.ts uses gray-matter without overriding executable js and javascript frontmatter...

PT-2026-60485

Name of the Vulnerable Software and Affected Versions Prompty versions prior to 2.0.0-beta.2 Description Prompty loaders fail to properly validate the resolution of $file:... references within .prompty frontmatter. This lack of enforcement allows the resolution of paths outside the intended promp...