Microsoft Prompty CVE-2026-73299: One File Gives Full RCE

In short: Positive Technologies discovered a critical remote code execution vulnerability CVE-2026-73299 (CVSS 10.0) in Microsoft Prompty, the open-source AI prompt engineering tool. A single specially crafted .prompty file is enough to execute arbitrary code on a developer's system with the application's own privileges. The patch was released September 2, 2026. The flaw affects tens of thousands of developers who use @prompty/core via npm, PyPI, or the Visual Studio Marketplace.

What Is Microsoft Prompty

Prompty is Microsoft's open-source tool for describing, testing, and running prompts for large language models (LLMs). Developers write prompt templates in .prompty files; the @prompty/core TypeScript package loads, renders, and sends those templates to LLM APIs. Prompty is distributed through npm and PyPI and is embedded in a Visual Studio Code extension, making it a core part of many AI agent and chatbot development workflows.

On September 2, 2026, Positive Technologies' AppSec Research team published details of a critical vulnerability found in this tool. The flaw was assigned CVE-2026-73299 with a CVSS 3.1 score of 10.0 — the highest possible rating. Remarkably, it was found using Positive Technologies' own new AI-powered vulnerability scanning technology: a security engineer needed just two minutes to review the scan results and confirm the exploit reproduced reliably.

The Flaw: Server-Side Template Injection in Nunjucks

The root cause is in the Nunjucks template engine that Prompty uses to render .prompty files. Nunjucks failed to restrict template access to JavaScript objects, allowing an attacker to "escape" the template sandbox and execute arbitrary JavaScript code inside the Node.js process — with the same system privileges held by the application itself. The vulnerability class is Server-Side Template Injection (SSTI).

The exploit chain is simple and requires no complex infrastructure:

1. The attacker crafts a malicious .prompty file with JavaScript exploit code embedded in the template body.
2. A developer opens the file in Prompty — it could have arrived from a public GitHub repository, from a colleague via messaging, through a code review system, or even been generated by an LLM during normal development work.
3. Prompty processes the template through Nunjucks — the malicious code immediately executes on the developer's machine.

Affected versions:

• @prompty/core up to and including 0.1.4
• @prompty/core 2.0.0-beta.4 and below

Fixed in versions 0.1.5 and 2.0.0-beta.5, released by Microsoft after receiving the Positive Technologies report.

The Wider Risk: Supply Chain Attack

At first glance this looks like a developer-only problem. But the downstream consequences go much further. Once an attacker controls a developer's machine, they can:

• Steal project secrets. API keys, authentication tokens, and database connection strings from .env files are all present in the development environment and unprotected against code running with application privileges.
• Plant a backdoor in the source code. Silently modify the product so the published application secretly exfiltrates user data or maintains a remote access channel.
• Poison the build pipeline. Through CI/CD systems (GitHub Actions, GitLab CI, Jenkins), a compromised developer environment can propagate malicious code to all end users simultaneously — a textbook supply chain attack, which has become one of the leading threat vectors of 2026.

End users of applications built on a compromised development environment may have no idea their data is being exfiltrated — the application continues to function normally. The risk is especially acute now that developers routinely download ready-made .prompty templates from public sources without inspecting their contents. For practical guidance on protecting your data online, visit the LiMP VPN security blog.

AI Found the Vulnerability in Two Minutes

The discovery story is equally notable. Positive Technologies used their own new AI-powered technology to automate code analysis for vulnerabilities and verify exploitability. A security engineer spent just two minutes reviewing the scan output — versus hours or days of manual audit.

This illustrates the dual nature of AI in security: the same tools that help researchers find flaws faster also lower the barrier for attackers to find and exploit them. The offense-defence arms race has entered a new dimension.

What to Do Now

Developers using Prompty:

• Update @prompty/core immediately: run npm update @prompty/core. Target versions are 0.1.5 or 2.0.0-beta.5.
• Verify your installed version: npm list @prompty/core.
• Update the Prompty extension in Visual Studio Code via the Extensions panel.
• Until updated, do not open .prompty files from external sources — repositories, messaging apps, or LLM-generated content.
• Run development tools in isolated environments (Docker, VM) with minimum required privileges to limit the blast radius of any compromise.

Application end users:

• Install app updates as soon as they are available — developers may quietly release a patch after discovering their build environment was compromised.
• Use LiMP VPN on public networks: traffic encryption protects your data at the network layer, even if a compromised application is quietly transmitting data to an external server.
• Use unique passwords and two-factor authentication on every service — this limits the damage if your data does reach an attacker through a supply chain attack.

Sources

• Positive Technologies / Habr — CVE-2026-73299: Critical Vulnerability in Microsoft Prompty (September 2, 2026)
• CNews — Positive Technologies AI Tool Finds Critical Vulnerability in Microsoft LLM Project (September 2, 2026)
• Forbes.ru — Positive Technologies Finds Critical Vulnerability in Microsoft AI Project