Description
The TypeScript Prompty loader used gray-matter without overriding executable frontmatter engines. gray-matter supports JavaScript frontmatter blocks such as ---js and evaluates them while parsing. An attacker-controlled .prompty file could therefore execute arbitrary JavaScript during prompt loading.
Recommendation
Update the @prompty/core package to the latest compatible version. Followings are version details:
- Affected version(s): >= 2.0.0-alpha.1, < 2.0.0-beta.3
- Patched version(s): 2.0.0-beta.3
References
Could your website be exposed too?
SmartScanner can check your website for Prompty: Arbitrary code execution via JavaScript frontmatter in TypeScript loader and gives you actionable findings to investigate.
Start a free scanRelated Issues
- Prompty: Arbitrary file read via file reference expansion - CVE-2026-53598
- HAX CMS: Stored XSS via '<video-player>' component allows arbitrary JavaScript execution and token theft - CVE-2026-46496
- Arbitrary code execution in protobufjs - CVE-2026-41242
- DbGate: Unauthenticated Remote Code Execution via JSON Script Runner - CVE-2026-47668
You might also like:
See something that needs correcting? Let us knowUpdated July 17, 2026