CVE-2026-73299 is a template injection vulnerability in the prompty file format that achieves remote code execution when a user opens a malicious .prompty file. The vulnerability affects versions prior to 0.1.5 (stable) and prior to 2.0.0-beta.5 (beta). If you're using prompty to render prompts from external sources — marketplaces, GitHub repositories, Discord channels, or collaborative workspaces — upgrade immediately to either of these versions.
The CVSS 10 rating is accurate but misleading. It frames this as a conventional server-side template injection, but the threat model here is inverted: prompty was built specifically to distribute and render untrusted .prompty files. The attack surface isn't a network service — it's the act of opening a file someone shared with you. The EPSS score of 0.01215 dramatically underweights this risk because it models probabilistic network exploitation, not the near-certainty of code execution when a user in a prompt-sharing community opens a malicious file that arrived through exactly the channels the tool is designed for.
The beta channel compounds this. Users running 2.0.0-beta.x versions weren't just testing features — they were processing untrusted templates through an unsandboxed renderer while using the tool for its intended purpose. The security boundary (treat .prompty bodies as untrusted) was never documented, so users had no signal that the 'share your prompts' workflow was also 'execute arbitrary code from that prompt you just downloaded.'
If you maintain prompt marketplaces, shared prompt repositories, or community channels where .prompty files circulate, treat this as a supply chain risk: a single malicious file can propagate through the entire social graph before anyone detects it. The fix exists in two release trains; ensure you're pulling from the correct channel. The vulnerability is in the code, but the exposure lives in the distribution ecosystem — and that's where detection and response planning matters most.