Understanding and Defending Against Arbitrary Code Execution in Prompty

Overview

The Prompty loader, used for loading prompts in TypeScript, is vulnerable to arbitrary JavaScript execution. This vulnerability arises from the loader's use of `gray-matter`, a library that supports JavaScript frontmatter blocks. An attacker-controlled `.prompty` file can execute arbitrary JavaScript during prompt loading, posing a significant risk to applications that load untrusted `.prompty` files or user-provided prompt paths.

Understanding the Vulnerability / Threat

Root Cause Analysis

The root cause of this vulnerability is the Prompty loader's use of `gray-matter` without overriding executable frontmatter engines. `gray-matter` supports JavaScript frontmatter blocks, such as `---js`, and evaluates them while parsing. This behavior allows an attacker to inject and execute arbitrary JavaScript code. This vulnerability belongs to the CWE-94 category, 'Improper Control of Generation of Code ('Code Injection')'. It is a design issue, as the loader does not properly restrict the execution of frontmatter code.

Attack Surface & Vector

The vulnerability affects the `@prompty/core` package in its v2 prerelease line, specifically versions `>= 2.0.0-alpha.1 < 2.0.0-beta.3`. The attack vector involves an attacker providing a malicious `.prompty` file that contains JavaScript frontmatter. This file can be loaded by an application that uses the vulnerable Prompty loader, potentially leading to arbitrary JavaScript execution in the host Node.js process. The attack surface includes applications that load untrusted `.prompty` files, user-provided prompt paths, or prompt bundles from less-trusted locations. An attacker must be able to provide or modify the `.prompty` file that is loaded by the application.

Exploitation Mechanics — Scenario Walkthrough

Scenario: Compromising a Corporate Prompty Instance 1. Initial Position: An attacker gains access to a corporate network and can provide or modify files used by the Prompty loader. 2. Triggering the Flaw: The attacker crafts a malicious `.prompty` file that includes a JavaScript frontmatter block (`---js`). When the Prompty loader parses this file, it evaluates the JavaScript code. 3. What Breaks: The security boundary fails because the Prompty loader does not properly restrict the execution of JavaScript frontmatter. The `gray-matter` library evaluates the JavaScript code in the frontmatter, allowing arbitrary code execution. 4. Attacker's Prize: The attacker gains the ability to execute arbitrary JavaScript in the host Node.js process. This can lead to various malicious activities, such as data exfiltration, lateral movement, or persistence.

Real-World Impact

The impact of this vulnerability is significant. An attacker can exploit it to execute arbitrary JavaScript in the host Node.js process, potentially leading to: - Data theft - Lateral movement within the network - Deployment of ransomware or other malicious payloads - Compromise of supply chain integrity

Detection & Defense

Immediate Mitigations

To address this vulnerability, upgrade `@prompty/core` to `2.0.0-beta.3` or later. This version explicitly overrides the `js` and `javascript` gray-matter engines and rejects JavaScript frontmatter in `.prompty` files.

Detection Strategies

Defenders can detect exploitation attempts by monitoring for unusual patterns in `.prompty` files or unexpected JavaScript execution in the Node.js process. Specific log patterns and SIEM rules can be implemented to identify potential attacks.

Long-Term Hardening

To prevent similar vulnerabilities, consider the following defensive strategies: - Implement strict validation and sanitization of user-provided input files. - Use secure coding practices to restrict the execution of untrusted code. - Regularly update and patch dependencies to ensure the latest security fixes are applied. - Use defense-in-depth strategies, such as least privilege and segmentation, to limit the impact of potential breaches.

Key Takeaways

- The Prompty loader's use of `gray-matter` without proper restrictions allows for arbitrary JavaScript execution. - The vulnerability affects `@prompty/core` versions `>= 2.0.0-alpha.1 < 2.0.0-beta.3`. - Upgrading to `@prompty/core@2.0.0-beta.3` or later mitigates the vulnerability. - Detection and defense strategies include monitoring for unusual patterns, implementing secure coding practices, and keeping dependencies up-to-date.

Sources

- GitHub Security Advisories: https://github.com/advisories/GHSA-c4gh-rv8h-q9vw - CVE-2026-53597: https://nvd.nist.gov/vuln/detail/CVE-2026-53597