CVE-2026-53598: Arbitrary File Read via File Reference Expansion in Microsoft Prompty

Vulnerability ID: CVE-2026-53598
CVSS Score: 7.5
Published: 2026-07-17

CVE-2026-53598 is a directory traversal and arbitrary file read vulnerability in Microsoft Prompty ecosystem loaders across multiple languages. Prior to version 2.0.0-beta.2, the loaders resolved ${file:...} reference strings inside frontmatter configuration blocks without enforcing that the target file paths resided within authorized directories. This deficiency allows an attacker-controlled configuration file to read sensitive operating system and application files through absolute paths, directory traversal, or symbolic link escapes. The issue is addressed across the Python, C#, Node.js/TypeScript, and Rust ecosystems.

TL;DR

Microsoft Prompty loaders before 2.0.0-beta.2 are vulnerable to arbitrary file read via directory traversal, absolute paths, or symbolic link escapes within frontmatter ${file:...} sequence expansions.

⚠️ Exploit Status: POC

Technical Details

• CWE ID: CWE-22 / CWE-200
• Attack Vector: Network (AV:N)
• CVSS v3.1: 7.5 (High)
• EPSS Score: 1.057% (60.65th percentile)
• Exploit Status: Proof-of-Concept (PoC) Available
• Impact: Arbitrary File Read (Confidentiality: High)
• CISA KEV: Not Listed

Affected Systems

• Microsoft Prompty Python Loader (prompty)
• Microsoft Prompty C# Loader (Prompty.Core)
• Microsoft Prompty TypeScript Loader (@prompty/core)
• Microsoft Prompty Rust Loader (prompty)
• prompty (Python): < 2.0.0b2 (Fixed in: 2.0.0b2)
• Prompty.Core (C#): < 2.0.0-beta.2 (Fixed in: 2.0.0-beta.2)
• @prompty/core (Node.js): < 2.0.0-beta.2 (Fixed in: 2.0.0-beta.2)
• prompty (Rust): < 2.0.0-beta.2 (Fixed in: 2.0.0-beta.2)

Code Analysis

Commit: 88ac994

Fix reference expansion path traversal vulnerabilities across Python, C#, Node.js, and Rust

C# / Python / TypeScript security validations added to verify candidate path canonicalization within authorized root paths.

Exploit Details

• GitHub Fix Commit Tests: The patch tests include complete replication scenarios demonstrating absolute path, symlink, and relative path escape failures.

Mitigation Strategies

• Upgrade Microsoft Prompty libraries to version 2.0.0-beta.2 or higher
• Restrict application upload capabilities for .prompty extension files from untrusted actors
• Sanitize input paths and ensure least privilege runtime execution to limit access scope of the application process

Remediation Steps:

1. Identify all applications utilizing the prompty, Prompty.Core, @prompty/core, or Rust prompty packages
2. Configure dependency files (requirements.txt, package.json, .csproj, Cargo.toml) to demand version 2.0.0-beta.2 or above
3. Run local dependency scanning or vulnerability assessment tools to verify the remediation is applied
4. Review application load configurations and explicitly specify allowed_file_roots only when necessary

References

• GitHub Security Advisory GHSA-wxhm-2mq7-7697
• Microsoft Prompty Fix Commit 88ac9948
• NVD - CVE-2026-53598 Detail
• CVE.org Record

Read the full report for CVE-2026-53598 on our website for more details including interactive diagrams and full exploit analysis.