Skip to main content
cve.nowby Sazabi
← npm
npmPackage

@prompty/core

3 known vulnerabilities (1 critical, 2 high), with the versions each affects and the releases that fix them.

Latest release
2.1.0 (Oct 21, 2026): no advisory affects it
Newest unaffected release
2.1.0 (Oct 21, 2026), the latest release
Advisories
3 · 1 critical, 2 high
Weekly downloads
316
Dependents
3
Releases
23 since 0.1.2 (Oct 14, 2024)
Registry
npm
Releases read
Nov 8, 2026

Version timeline

  • CVE-2026-73299
    Affects 0.1.2 to 0.1.4 (0.1.5 is outside it); 2.0.0-alpha.1 to 2.0.0-beta.4 (2.0.0-beta.5 is outside it)
  • CVE-2026-53598
    Affects 0.1.2 to 2.0.0-beta.1 (2.0.0-beta.2 is outside it)
  • CVE-2026-53597
    Affects 2.0.0-alpha.1 to 2.0.0-beta.2 (2.0.0-beta.3 is outside it)
Every release cve.now has on record, lowest version on the left; each bar is a run of versions an advisory affects.

Advisories 3

  • CVE-2026-73299Critical 10.0

    Prompty: Server-Side Template Injection to Remote Code Execution in the @prompty/core Nunjucks Renderer

    Affected: fixed in 0.1.5; from 2.0.0-alpha.1, fixed in 2.0.0-beta.5.

    Fixed in 0.1.5 (released Jul 20, 2026, 23 days before disclosure) and 2.0.0-beta.5 (released Jul 20, 2026, 23 days before disclosure).

    The latest release, 2.1.0, is not affected.

    19% of @prompty/core downloads last week were affected versions (50).

  • Prompty: Arbitrary File Read via ${file:path} Reference Expansion

    Affected: fixed in 2.0.0-beta.2.

    Fixed in 2.0.0-beta.2 (released Jun 6, 2026, 40 days before disclosure).

    The latest release, 2.1.0, is not affected.

    21% of @prompty/core downloads last week were affected versions (57).

  • Prompty: Arbitrary code execution via JavaScript frontmatter in TypeScript loader

    Affected: from 2.0.0-alpha.1, fixed in 2.0.0-beta.3.

    Fixed in 2.0.0-beta.3 (released Jun 6, 2026, 40 days before disclosure).

    The latest release, 2.1.0, is not affected.

    14% of @prompty/core downloads last week were affected versions (37).