Prompty’s markdown files are parsed by a TypeScript Nunjucks renderer that, before version 0.1.5 and 2.0.0‑beta.5, evaluated untrusted template bodies with unrestricted JavaScript member access. An attacker who can supply a crafted .prompty file can traverse constructor and prototype properties and execute arbitrary JavaScript in the host Node.js process. The vulnerability is therefore a classic server‑side template injection that can lead to remote code execution.

Microsoft Prompty is the vendor; affected versions are all releases older than 0.1.5 and 2.0.0‑beta.5. Any deployment that processes untrusted .prompty files through the default Nunjucks renderer is potentially impacted.

The CVSS score is 10, indicating extreme severity. The EPSS score of 0.01215 (≈1.2%) indicates a very low probability of exploitation, but the lack of a KEV listing suggests no publicly confirmed exploits yet. The attack path requires the attacker to deliver a malicious template—likely via user input, file upload, or external API—and the vulnerability can be leveraged once the template is parsed, making it a straightforward local or remote code execution vector depending on how the template is introduced.