Prompty, a Markdown-based prompt format used by Microsoft, contained a flaw in its TypeScript loader that allows an attacker-controlled file to include a JavaScript frontmatter section. During prompt loading, the loader utilized the gray‑matter library without disabling the default JavaScript engine, resulting in the arbitrary execution of that frontmatter code. This is categorized as CWE‑94, a code injection weakness that can compromise confidentiality, integrity, and availability of the system hosting the loader.

The vulnerability affects user deployments of Microsoft Prompty, specifically any use of the @prompty/core package between versions 2.0.0‑alpha.1 and 2.0.0‑beta.2 inclusive. The loader resides in runtime/typescript/packages/core/src/core/loader.ts and, during that period, did not override gray‑matter’s default handling of 'js' frontmatter, leaving the execution engine enabled.

The CVSS score of 8.7 indicates a high severity vulnerability. The EPSS score of less than 1% signifies a low but non-zero probability of exploitation, and the vulnerability is not listed in CISA KEV. The likely attack path involves supply of a crafted .prompty file containing malicious JavaScript in the frontmatter; when the loader processes that file, the JavaScript executes with the privileges of the running Prompty process. Successful exploitation could allow an attacker to execute arbitrary code, modify system state, or compromise data stored or accessed by the Prompty environment.