## Summary Prompty loaders expanded `${file:...}` references in `.prompty` frontmatter without enforcing that the resolved path stayed within an authorized directory. An attacker-controlled prompt file could use path traversal or an absolute path to cause the host application to read files accessible to the process. ## Affected packages - PyPI `prompty` versions `<= 2.0.0b1`; fixed in `2.0.0b2` - npm `@prompty/core` versions `<= 2.0.0-beta.1`; fixed in `2.0.0-beta.2` - crates.io `prompty` versions `<= 2.0.0-beta.1`; fixed in `2.0.0-beta.2` - NuGet `Prompty.Core` versions `<= 2.0.0-beta.1`; fixed in `2.0.0-beta.2` ## Impact Applications that load untrusted `.prompty` files, user-provided prompt paths, or prompt bundles from less-trusted locations could disclose local files available to the application process when expanded values are logged, returned, or otherwise exposed. ## Remediation Upgrade to the fixed runtime version for your ecosystem. The fix makes file references secure by default: `${file:...}` may only resolve within the directory tree containing the `.prompty` file. Host applications that need shared prompt assets outside that tree must explicitly provide allowed file roots through runtime load options. Absolute paths, `..` traversal, and symlink escapes outside allowed roots are rejected. ## Fix details The patched runtimes canonicalize file-reference targets and allowed roots before reading referenced files, reject targets outside the prompt directory by default, and add regression coverage for traversal, absolute paths, explicit allowlists, and symlink escapes. The release commit is `88ac9948d7d37995edbb2f6d36913436626c39e1`.
## Summary Prompty loaders expanded `${file:...}` references in `.prompty` frontmatter without enforcing that the resolved path stayed within an authorized directory. An attacker-controlled prompt file could use path traversal or an absolute path to cause the host application to read files accessible to the process. ## Affected packages - PyPI `prompty` versions `<= 2.0.0b1`; fixed in `2.0.0b2` - npm `@prompty/core` versions `<= 2.0.0-beta.1`; fixed in `2.0.0-beta.2` - crates.io `prompty` versions `<= 2.0.0-beta.1`; fixed in `2.0.0-beta.2` - NuGet `Prompty.Core` versions `<= 2.0.0-beta.1`; fixed in `2.0.0-beta.2` ## Impact Applications that load untrusted `.prompty` files, user-provided prompt paths, or prompt bundles from less-trusted locations could disclose local files available to the application process when expanded values are logged, returned, or otherwise exposed. ## Remediation Upgrade to the fixed runtime version for your ecosystem. The fix makes file references secure by default: `${file:...}` may only resolve within the directory tree containing the `.prompty` file. Host applications that need shared prompt assets outside that tree must explicitly provide allowed file roots through runtime load options. Absolute paths, `..` traversal, and symlink escapes outside allowed roots are rejected. ## Fix details The patched runtimes canonicalize file-reference targets and allowed roots before reading referenced files, reject targets outside the prompt directory by default, and add regression coverage for traversal, absolute paths, explicit allowlists, and symlink escapes. The release commit is `88ac9948d7d37995edbb2f6d36913436626c39e1`.
Update @prompty/core to 2.0.0-beta.2; Prompty.Core to 2.0.0-beta.2; prompty to 2.0.0b2; prompty to 2.0.0-beta.2 if you use the affected versions. Test the change in a non-production environment first.
Local check
hol-guard supply-chain scanPrompty: Arbitrary file read via file reference expansion affects @prompty/core (npm), Prompty.Core (nuget), prompty (pip), prompty (rust). Severity is high. ## Summary Prompty loaders expanded `${file:...}` references in `.prompty` frontmatter without enforcing that the resolved path stayed within an authorized directory. An attacker-controlled prompt file could use path traversal or an absolute path to cause the host application to read files accessible to the process. ## Affected packages - PyPI `prompty` versions `<= 2.0.0b1`; fixed in `2.0.0b2` - npm `@prompty/core` versions `<= 2.0.0-beta.1`; fixed in `2.0.0-beta.2` - crates.io `prompty` versions `<= 2.0.0-beta.1`; fixed in `2.0.0-beta.2` - NuGet `Prompty.Core` versions `<= 2.0.0-beta.1`; fixed in `2.0.0-beta.2` ## Impact Applications that load untrusted `.prompty` files, user-provided prompt paths, or prompt bundles from less-trusted locations could disclose local files available to the application process when expanded values are logged, returned, or otherwise exposed. ## Remediation Upgrade to the fixed runtime version for your ecosystem. The fix makes file references secure by default: `${file:...}` may only resolve within the directory tree containing the `.prompty` file. Host applications that need shared prompt assets outside that tree must explicitly provide allowed file roots through runtime load options. Absolute paths, `..` traversal, and symlink escapes outside allowed roots are rejected. ## Fix details The patched runtimes canonicalize file-reference targets and allowed roots before reading referenced files, reject targets outside the prompt directory by default, and add regression coverage for traversal, absolute paths, explicit allowlists, and symlink escapes. The release commit is `88ac9948d7d37995edbb2f6d36913436626c39e1`.
AI coding agents often install or upgrade packages automatically in npm, nuget, pip and rust. A high vulnerability in a dependency can be pulled into a project through a normal install or update without a human reviewing the change, expanding the blast radius from a single package to every agent workspace that depends on it.
| Package | Affected range | Fixed version |
|---|---|---|
| @prompty/corenpm | <=2.0.0-beta.1 | 2.0.0-beta.2 |
| Prompty.Corenuget | <=2.0.0-beta.1 | 2.0.0-beta.2 |
| promptypip | <=2.0.0b1 | 2.0.0b2 |
| promptyrust | <=2.0.0-beta.1 | 2.0.0-beta.2 |
Fixed versions are reported by the source feed; confirm compatibility before updating.
Reported by GitHub Security Advisories (ghsa).
HOL Guard can help your team review package activity against supported protection paths.
Explore HOL GuardUpdate @prompty/core to 2.0.0-beta.2; Prompty.Core to 2.0.0-beta.2; prompty to 2.0.0b2; prompty to 2.0.0-beta.2 if you use the affected versions. Test the change in a non-production environment first.
Local check
hol-guard supply-chain scanPrompty: Arbitrary file read via file reference expansion affects @prompty/core (npm), Prompty.Core (nuget), prompty (pip), prompty (rust). Severity is high. ## Summary Prompty loaders expanded `${file:...}` references in `.prompty` frontmatter without enforcing that the resolved path stayed within an authorized directory. An attacker-controlled prompt file could use path traversal or an absolute path to cause the host application to read files accessible to the process. ## Affected packages - PyPI `prompty` versions `<= 2.0.0b1`; fixed in `2.0.0b2` - npm `@prompty/core` versions `<= 2.0.0-beta.1`; fixed in `2.0.0-beta.2` - crates.io `prompty` versions `<= 2.0.0-beta.1`; fixed in `2.0.0-beta.2` - NuGet `Prompty.Core` versions `<= 2.0.0-beta.1`; fixed in `2.0.0-beta.2` ## Impact Applications that load untrusted `.prompty` files, user-provided prompt paths, or prompt bundles from less-trusted locations could disclose local files available to the application process when expanded values are logged, returned, or otherwise exposed. ## Remediation Upgrade to the fixed runtime version for your ecosystem. The fix makes file references secure by default: `${file:...}` may only resolve within the directory tree containing the `.prompty` file. Host applications that need shared prompt assets outside that tree must explicitly provide allowed file roots through runtime load options. Absolute paths, `..` traversal, and symlink escapes outside allowed roots are rejected. ## Fix details The patched runtimes canonicalize file-reference targets and allowed roots before reading referenced files, reject targets outside the prompt directory by default, and add regression coverage for traversal, absolute paths, explicit allowlists, and symlink escapes. The release commit is `88ac9948d7d37995edbb2f6d36913436626c39e1`.
AI coding agents often install or upgrade packages automatically in npm, nuget, pip and rust. A high vulnerability in a dependency can be pulled into a project through a normal install or update without a human reviewing the change, expanding the blast radius from a single package to every agent workspace that depends on it.
| Package | Affected range | Fixed version |
|---|---|---|
| @prompty/corenpm | <=2.0.0-beta.1 | 2.0.0-beta.2 |
| Prompty.Corenuget | <=2.0.0-beta.1 | 2.0.0-beta.2 |
| promptypip | <=2.0.0b1 | 2.0.0b2 |
| promptyrust | <=2.0.0-beta.1 | 2.0.0-beta.2 |
Fixed versions are reported by the source feed; confirm compatibility before updating.
Reported by GitHub Security Advisories (ghsa).
HOL Guard can help your team review package activity against supported protection paths.
Explore HOL Guard