CVE-2026-53598
Received Received - Intake

Path Traversal in Prompty Markdown File Loader

Publication date: 2026-07-16

Last updated on: 2026-07-16

Assigner: GitHub, Inc.

Description
Prompty is a markdown file format (.prompty) for LLM prompts. Prior to 2.0.0-beta.2, Prompty loaders expanded ${file:...} references in .prompty frontmatter without enforcing that resolved paths stayed within the prompt directory or allowed roots, allowing an attacker-controlled prompt file to read local files through absolute paths, .. traversal, or symlink escapes. This issue is fixed in versions 2.0.0-beta.2.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-07-16
Last Modified
2026-07-16
Generated
2026-07-16
AI Q&A
2026-07-16
EPSS Evaluated
N/A
NVD
CVE-2026-53598
EUVD
EUVD-2026-44940

Affected Vendors & Products

Showing 2 associated CPEs
Vendor Product Version / Range
microsoft prompty From 2.0.0-beta.2 (inc)
microsoft prompty to 2.0.0-beta.2 (exc)

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-200 The product exposes sensitive information to an actor that is not explicitly authorized to have access to that information.
CWE-22 The product uses external input to construct a pathname that is intended to identify a file or directory that is located underneath a restricted parent directory, but the product does not properly neutralize special elements within the pathname that can cause the pathname to resolve to a location that is outside of the restricted directory.

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

CVE-2026-53598 is an arbitrary file read vulnerability in the Prompty framework. It occurs because the software improperly handles file reference expansions in .prompty files. Attackers can exploit this by using path traversal, absolute paths, or symlink escapes to read local files outside the intended directory.

Detection Guidance

To detect this vulnerability, check if your system uses Prompty versions prior to 2.0.0-beta.2. Run commands like 'npm list @microsoft/prompty' for npm, 'dotnet list package' for NuGet, 'pip show prompty' for pip, or 'cargo tree -p prompty' for Rust to verify installed versions. Inspect .prompty files for ${file:...} references that use absolute paths, directory traversal (../), or symlinks outside the prompt directory.

Impact Analysis

This vulnerability allows attackers to read sensitive files on the system where the Prompty application runs. This could include configuration files, source code, or other confidential data. The impact is high due to the potential for unauthorized data exposure.

Compliance Impact

This vulnerability could lead to non-compliance with data protection regulations like GDPR or HIPAA by exposing sensitive personal or health information. Unauthorized file access may result in data breaches, triggering legal penalties and reputational damage.

Mitigation Strategies

Upgrade Prompty to version 2.0.0-beta.2 or later across all package ecosystems (npm, NuGet, pip, Rust). If upgrading is not immediately possible, restrict file access permissions on .prompty files and directories to limit exposure. Review and remove any ${file:...} references using absolute paths or traversal in .prompty files until patched versions are deployed.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-53598. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart