{"action":"Upgrade @prompty/core to 2.0.0-beta.3 or later.","affected":[{"fixed":"2.0.0-beta.3","introduced":"2.0.0-alpha.1"}],"component":"@prompty/core","cve_ids":["CVE-2026-53597"],"ecosystem":"npm","epss":0.00972,"exploited":false,"fixed_versions":["2.0.0-beta.3"],"ghsa_id":"GHSA-c4gh-rv8h-q9vw","id":"tcs_01M5KFHQ2MGY2ANVGR4VARS9AB","modified_at":"2026-07-17T20:00:17.099953006Z","published_at":"2026-07-17T19:53:34Z","references":["https://osv.dev/vulnerability/GHSA-c4gh-rv8h-q9vw","https://github.com/microsoft/prompty/security/advisories/GHSA-c4gh-rv8h-q9vw","https://nvd.nist.gov/vuln/detail/CVE-2026-53597","https://github.com/microsoft/prompty/commit/c27402da2487075be577f06aa79df627fb9d6853","https://github.com/microsoft/prompty"],"severity":{"label":"high","score":8.7},"sources":[{"source":"osv","source_id":"GHSA-c4gh-rv8h-q9vw","url":"https://osv.dev/vulnerability/GHSA-c4gh-rv8h-q9vw"},{"source":"nvd","source_id":"CVE-2026-53597","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-53597"}],"summary":"Prompty: Arbitrary code execution via JavaScript frontmatter in TypeScript loader"}