Prompty: Arbitrary code execution via JavaScript frontmatter in TypeScript loader (CVE-2026-53597) | HOL Guard CVE