{"action":"Upgrade @prompty/core to 0.1.5 or later.","affected":[{"fixed":"0.1.5","introduced":"0"},{"fixed":"2.0.0-beta.5","introduced":"2.0.0-alpha.1"}],"component":"@prompty/core","cve_ids":["CVE-2026-73299"],"ecosystem":"npm","epss":0.01784,"exploited":false,"fixed_versions":["0.1.5","2.0.0-beta.5"],"ghsa_id":"GHSA-w28w-gp39-m4p6","id":"tcs_01M5KGDH94V0N8ET33TM6QQB92","modified_at":"2026-08-13T04:11:08.015471511Z","published_at":"2026-07-24T16:23:59Z","references":["https://osv.dev/vulnerability/GHSA-w28w-gp39-m4p6","https://github.com/microsoft/prompty/security/advisories/GHSA-w28w-gp39-m4p6","https://github.com/microsoft/prompty/pull/404","https://github.com/microsoft/prompty/commit/047756f4c8caf91c5868eeb42520c938393277b0","https://github.com/microsoft/prompty"],"severity":{"label":"critical","score":10},"sources":[{"source":"osv","source_id":"GHSA-w28w-gp39-m4p6","url":"https://osv.dev/vulnerability/GHSA-w28w-gp39-m4p6"}],"summary":"Prompty: Server-Side Template Injection to Remote Code Execution in the @prompty/core Nunjucks Renderer"}