Code Injection

@prompty/core is vulnerable to Code Injection. The vulnerability is due to the use of gray-matter with executable JavaScript frontmatter enabled, which allows an attacker to execute arbitrary JavaScript by supplying a malicious .prompty file...

Directory Traversal

Overview Affected versions of this package are vulnerable to Directory Traversal via the file reference expansion process. An attacker can access arbitrary files available to the application process by supplying a specially crafted .prompty file containing $file:... references that use path...