PYSEC-2026-3538Published

Prompty: Arbitrary File Read via ${file:path} Reference Expansion

cve-program · CVE-2026-53598

Published

prompty

Vendor product

Original vendor version evidence · not evaluated as a NuGet range

{
                    "vendor": "microsoft",
                    "product": "prompty",
                    "versions": [
                        {
                            "version": "< 2.0.0-beta.2",
                            "status": "affected"
                        }
                    ]
                }

nvd · CVE-2026-53598

Published

No affected-package array is stated in this source revision. Check its state and earlier observations; this does not establish that every package is unaffected.

osv · GHSA-wxhm-2mq7-7697

Published

prompty

PyPI

ECOSYSTEM · introduced 0 → fixed 2.0.0b2

47 explicitly affected versions

0.1.1, 0.1.10, 0.1.12, 0.1.13, 0.1.14, 0.1.15, 0.1.16, 0.1.17, 0.1.18, 0.1.19, 0.1.20, 0.1.21, 0.1.22, 0.1.23, 0.1.24, 0.1.33, 0.1.34, 0.1.36, 0.1.37, 0.1.38, 0.1.39, 0.1.40, 0.1.44, 0.1.45, 0.1.46, 0.1.47, 0.1.48, 0.1.49, 0.1.50, 0.1.7, 0.1.8, 0.1.9, 1.0.0a1, 1.0.0a2, 1.0.0b1, 1.0.0b2, 1.0.0b3, 2.0.0a1, 2.0.0a2, 2.0.0a3, 2.0.0a4, 2.0.0a5, 2.0.0a6, 2.0.0a7, 2.0.0a8, 2.0.0a9, 2.0.0b1

@prompty/core

npm

SEMVER · introduced 0 → fixed 2.0.0-beta.2

prompty

crates.io

SEMVER · introduced 0 → fixed 2.0.0-beta.2

Prompty.Core

NuGet

ECOSYSTEM · introduced 0 → fixed 2.0.0-beta.2

1 explicitly affected versions

0.2.3-beta