Your RSA-2048 keys break in 2030. Find every one of them before attackers do.
🦀
🦀 crates.io📦 npm.NET NuGet🐍 PyPI
Not in CISA KEV
HIGH severity

Prompty: Arbitrary file read via file reference expansionGHSA-wxhm-2mq7-7697

HIGHFix: microsoft/prompty@88ac994

GHSA-wxhm-2mq7-7697 is a high-severity (CVSS 7.5) Path Traversal vulnerability in prompty. A fix is available for prompty — see the affected versions and patch details below.

Also known asCVE-2026-53598PYSEC-2026-3538
Published
Updated
Affected
4 pkgs
Patched
4 / 4
Exploits
None indexed
Exploitation data as of Oct 15, 2026 · OSV.dev, NVD, FIRST.org (EPSS)

Exploitation Status

No confirmed exploitation observed yet

  • CISA assesses this as automatable — exploitation doesn’t require manual, per-target effort, which raises the odds of mass scanning and opportunistic attacks.
  • CISA’s own triage has not observed active exploitation or public proof-of-concept code for this CVE as of its last assessment.

Exploitation and automatability from CISA’s SSVC triage for GHSA-wxhm-2mq7-7697.

EPSS Exploitation Probability

via FIRST.org ↗
1.3%probability of exploitation in next 30 days
Lower Risk0.00%
Lower risk than most CVEs70th percentile — riskier than 70% of all scored CVEsHighest risk
0.56%0.97%1.38%1.79%1.1%1.3%1.3%1.3%Aug 26Oct 26Oct 26

Probability of exploitation in the next 30 days, from FIRST.org EPSS.

How urgent is this, really

GHSA-wxhm-2mq7-7697 by exploitation likelihood (EPSS) against impact (CVSS). Outside the shaded patch-first corner.

Where this sits among everything scored

Of 389,824 CVEs with a current EPSS score, this one falls in the < 10% band (highlighted). Counts from FIRST.org, log-scaled.

Real-World Exposure

4 pkgs affected

How broadly this vulnerability is actually deployed: weekly install volume shows current usage, and reverse-dependency count shows how many other packages break if it stays unpatched.

3other npm packages depend on this — each one inherits the vulnerability until it's patched upstream
@prompty/corenpm
160downloads / week

Description

Summary

Prompty loaders expanded ${file:...} references in .prompty frontmatter without enforcing that the resolved path stayed within an authorized directory. An attacker-controlled prompt file could use path traversal or an absolute path to cause the host application to read files accessible to the process.

Affected packages

  • PyPI prompty versions <= 2.0.0b1; fixed in 2.0.0b2
  • npm @prompty/core versions <= 2.0.0-beta.1; fixed in 2.0.0-beta.2
  • crates.io prompty versions <= 2.0.0-beta.1; fixed in 2.0.0-beta.2
  • NuGet Prompty.Core versions <= 2.0.0-beta.1; fixed in 2.0.0-beta.2

Impact

Applications that load untrusted .prompty files, user-provided prompt paths, or prompt bundles from less-trusted locations could disclose local files available to the application process when expanded values are logged, returned, or otherwise exposed.

Remediation

Upgrade to the fixed runtime version for your ecosystem. The fix makes file references secure by default: ${file:...} may only resolve within the directory tree containing the .prompty file. Host applications that need shared prompt assets outside that tree must explicitly provide allowed file roots through runtime load options. Absolute paths, .. traversal, and symlink escapes outside allowed roots are rejected.

Fix details

The patched runtimes canonicalize file-reference targets and allowed roots before reading referenced files, reject targets outside the prompt directory by default, and add regression coverage for traversal, absolute paths, explicit allowlists, and symlink escapes. The release commit is 88ac9948d7d37995edbb2f6d36913436626c39e1.

Affected Packages

4 total 4 fixed
EcosystemPackageVulnerable rangeFix
🦀crates.iopromptyall versions2.0.0-beta.2cargo update -p prompty --precise 2.0.0-beta.2
📦npm@prompty/coreall versions2.0.0-beta.2npm install @prompty/core@2.0.0-beta.2
.NETNuGetPrompty.Coreall versions2.0.0-beta.2dotnet add package Prompty.Core --version 2.0.0-beta.2
🐍PyPIpromptyall versions2.0.0b2pip install --upgrade 'prompty==2.0.0b2'

Detection & mitigation playbook

Open-source dependency

  1. Detect

    Scan your dependency tree (package-lock.json, pnpm-lock.yaml, requirements.txt, go.sum, etc.) for prompty, including transitive dependencies — a direct dependency you never call can still pull in a vulnerable version.

  2. Fix

    Update prompty to 2.0.0-beta.2 or later, then make sure no transitive (indirect) dependency still pins the vulnerable range — O3 confirms GHSA-wxhm-2mq7-7697 is resolved across your whole dependency graph.

  3. Workarounds

    Resolve every user-supplied path to its canonical form and reject anything that escapes the intended directory, and run the component under an account that has no read or write access outside the directory it legitimately serves.

Frequently Asked Questions

## Summary Prompty loaders expanded `${file:...}` references in `.prompty` frontmatter without enforcing that the resolved path stayed within an authorized directory. An attacker-controlled prompt file could use path traversal or an absolute path to cause the host application to read files accessible to the process. ## Affected packages - PyPI `prompty` versions `<= 2.0.0b1`; fixed in `2.0.0b2` - npm `@prompty/core` versions `<= 2.0.0-beta.1`; fixed in `2.0.0-beta.2` - crates.io `prompty` versions `<= 2.0.0-beta.1`; fixed in `2.0.0-beta.2` - NuGet `Prompty.Core` versions `<= 2.0.0-beta.1`; fi
O3 Security · Impact-Aware SCA

Is GHSA-wxhm-2mq7-7697 in your dependencies?

Find it across crates.io, npm, NuGet, including transitive dependencies.

Scan my dependencies How O3 SCA works
Prompty: Arbitrary file read via file reference expansion