Back www.thehackerwire.com

CVE-2026-73299 TheHackerWire / 13h Attack Vector How the vulnerability can be exploited Network Prior to 0.1.5 and 2.0.0-beta.5, the TypeScript Nunjucks renderer evaluated untrusted .prompty template bodies with unrestricted JavaScript member access.

www.thehackerwire.com • August 13, 2026

Prompty is a markdown file format (.prompty) for LLM prompts. Prior to 0.1.5 and 2.0.0-beta.5, the TypeScript Nunjucks renderer evaluated untrusted .prompty template bodies with unrestricted JavaScript member access. An attacker-controlled template could traverse constructor and prototype properties to execute JavaScript in the host Node.js process. This issue is fixed in versions 0.1.5 and 2.0.0-beta.5.

Modify values to recalculate the CVSS score in real-time

Stay informed the most severe security threats discovered this week

The full story

This article is one source in a clustered incident — the cluster page carries the summary, timeline and every other outlet covering it.

Critical RCE Vulnerability in Prompty (CVE-2026-73299) Requires Immediate Action CVE-2026-73299 is a critical remote code execution vulnerability in the TypeScript Nunjucks renderer of Prompty, affecting versions prior to 0.1.5 and 2.0.0-beta.5. An unauthenticated attacker can exploit this flaw by uploading a malicious .prompty template file, allowing them to execute arbitrary JavaScript in the Node.js process. The vulnerability has been assigned a CVSS base score of 10, indicating its critical nature. Currently, there is no evidence of public proof-of-concept or active exploitation. Users are advised to upgrade to the patched versions and restrict access to .prompty file uploads. The vulnerability was published on 2026-08-12, with immediate intervention recommended due to its severe implications. 1 sources 84

Extracted Entities

CVE-2026-73299 TheHackerWire / 13h Attack Vector How the vulnerability can be exploited Network Prior to 0.1.5 and 2.0.0-beta.5, the TypeScript Nunjucks renderer evaluated untrusted .prompty template bodies with unrestricted JavaScript member access.

The full story

Extracted Entities

Attack Types (1)

CVEs (1)

CWE Weaknesses (1)

MITRE ATT&CK (1)

Tools (1)