https://vulnerability.circl.lu Contains only the most 10 recent entries. http://www.rssboard.org/rss-specification python-feedgen en Fri, 02 Oct 2026 09:14:39 +0000 https://vulnerability.circl.lu/vuln/cve-2026-53598 <p><strong>Affected:</strong> microsoft prompty</p> <p>Prompty is a markdown file format (.prompty) for LLM prompts. Prior to 2.0.0-beta.2, Prompty loaders expanded ${file:...} references in .prompty frontmatter without enforcing that resolved paths stayed within the prompt directory or allowed roots, allowing an attacker-controlled prompt file to read local files through absolute paths, .. traversal, or symlink escapes. This issue is fixed in versions 2.0.0-beta.2.</p> <p><strong>Affected:</strong> microsoft prompty</p> <p>Prompty is a markdown file format (.prompty) for LLM prompts. Prior to 2.0.0-beta.2, Prompty loaders expanded ${file:...} references in .prompty frontmatter without enforcing that resolved paths stayed within the prompt directory or allowed roots, allowing an attacker-controlled prompt file to read local files through absolute paths, .. traversal, or symlink escapes. This issue is fixed in versions 2.0.0-beta.2.</p> https://vulnerability.circl.lu/vuln/cve-2026-53598 https://vulnerability.circl.lu/vuln/ghsa-wxhm-2mq7-7697 <p><strong>Affected:</strong> PyPI: prompty, npm: @prompty/core, crates.io: prompty, NuGet: Prompty.Core</p> <p>## Summary Prompty loaders expanded `${file:...}` references in `.prompty` frontmatter without enforcing that the resolved path stayed within an authorized directory. An attacker-controlled prompt file could use path traversal or an absolute path to cause the host application to read files accessible to the process.</p> <p>## Affected packages - PyPI `prompty` versions `&lt;= 2.0.0b1`; fixed in `2.0.0b2` - npm `@prompty/core` versions `&lt;= 2.0.0-beta.1`; fixed in `2.0.0-beta.2` - crates.io `prompty` versions `&lt;= 2.0.0-beta.1`; fixed in `2.0.0-beta.2` - NuGet `Prompty.Core` versions `&lt;= 2.0.0-beta.1`; fixed in `2.0.0-beta.2`</p> <p>## Impact Applications that load untrusted `.prompty` files, user-provided prompt paths, or prompt bundles from less-trusted locations could disclose local files available to the application process when expanded values are logged, returned, or otherwise exposed.</p> <p>## Remediation Upgrade to the fixed runtime version for your ecosystem. The fix makes file references secure by default: `${file:...}` may only resolve within the directory tree containing the `.prompty` file. Host applications that need shared prompt assets outside that tree must explicitly provide allowed file roots through runtime load options. Absolute paths, `..` traversal, and symlink escapes outside allowed roots are rejected.</p> <p>## Fix details The patched runtimes canonicalize file-reference targets and allowed roots before reading referenced files, reject targets outside the prompt directory by de…</p> <p><strong>Affected:</strong> PyPI: prompty, npm: @prompty/core, crates.io: prompty, NuGet: Prompty.Core</p> <p>## Summary Prompty loaders expanded `${file:...}` references in `.prompty` frontmatter without enforcing that the resolved path stayed within an authorized directory. An attacker-controlled prompt file could use path traversal or an absolute path to cause the host application to read files accessible to the process.</p> <p>## Affected packages - PyPI `prompty` versions `&lt;= 2.0.0b1`; fixed in `2.0.0b2` - npm `@prompty/core` versions `&lt;= 2.0.0-beta.1`; fixed in `2.0.0-beta.2` - crates.io `prompty` versions `&lt;= 2.0.0-beta.1`; fixed in `2.0.0-beta.2` - NuGet `Prompty.Core` versions `&lt;= 2.0.0-beta.1`; fixed in `2.0.0-beta.2`</p> <p>## Impact Applications that load untrusted `.prompty` files, user-provided prompt paths, or prompt bundles from less-trusted locations could disclose local files available to the application process when expanded values are logged, returned, or otherwise exposed.</p> <p>## Remediation Upgrade to the fixed runtime version for your ecosystem. The fix makes file references secure by default: `${file:...}` may only resolve within the directory tree containing the `.prompty` file. Host applications that need shared prompt assets outside that tree must explicitly provide allowed file roots through runtime load options. Absolute paths, `..` traversal, and symlink escapes outside allowed roots are rejected.</p> <p>## Fix details The patched runtimes canonicalize file-reference targets and allowed roots before reading referenced files, reject targets outside the prompt directory by de…</p> https://vulnerability.circl.lu/vuln/ghsa-wxhm-2mq7-7697