Loading story…
A high-severity vulnerability tracked as CVE-2026-53597 was disclosed in Microsoft’s Prompty project, where the @prompty/core TypeScript loader could execute attacker-controlled JavaScript embedded in .prompty files. The issue stemmed from use of gray-matter without disabling executable js and javascript frontmatter engines, creating a CWE-94 arbitrary code execution condition during prompt loading. Affected versions span 2.0.0-alpha.1 through versions before 2.0.0-beta.3.
Microsoft addressed the flaw by changing the Prompty TypeScript runtime to explicitly reject executable frontmatter instead of parsing it. The fix, committed in microsoft/prompty@c27402d, adds a rejectExecutableFrontmatter function that throws an error when JavaScript frontmatter is encountered, and includes a test confirming malicious frontmatter cannot execute code or create files. The remediation was released as part of coordinated package updates to 2.0.0-beta.3 across @prompty/core and related packages including @prompty/anthropic, @prompty/openai, and @prompty/foundry.
Mallory correlates global threat intelligence with your attack surface — know if you’re exposed before adversaries strike.
2 events from the most recent confirmed update back to the earliest known activity.
CVE-2026-53597 was published describing an arbitrary code execution vulnerability in Microsoft's Prompty project caused by executable JavaScript frontmatter handling in the @prompty/core TypeScript loader. The notice states versions from 2.0.0-alpha.1 through before 2.0.0-beta.3 are affected and that 2.0.0-beta.3 contains the fix.
A GitHub commit for Microsoft Prompty changed the TypeScript loader to reject JavaScript frontmatter in .prompty files and added a test to verify malicious frontmatter does not execute. The same change bumped @prompty/core and related packages from 2.0.0-beta.2 to 2.0.0-beta.3, indicating the fix was released in that version.
Vulnerabilities, threat actors, malware, products, organizations, and breaches Mallory has linked to this story.
3 references tracked. Mallory keeps watching after this page renders.
cvereports.com
Open sourcecvefeed.io
Open sourcegithub.com
Open sourceMap indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
A critical vulnerability (CVE-2025-65108, CVSS 10.0) has been identified in the `md-to-pdf` tool, which is used to convert Markdown files to PDF using Node.js and headless Chrome. The flaw allows attackers to achieve remote code execution by injecting malicious JavaScript into the front-matter section of Markdown files, exploiting the way the gray-matter library parses these blocks. This vulnerability is remotely exploitable and poses a significant risk to any system processing untrusted Markdown files with affected versions of `md-to-pdf`. The issue has been addressed in version 5.2.5 of the `md-to-pdf` library, and users are strongly advised to update to this version to mitigate the risk. No specific affected product versions are listed, but the vulnerability impacts all prior versions that use the vulnerable parsing mechanism. Security advisories have been published to highlight the severity and exploitation potential of this flaw, emphasizing the need for immediate remediation in environments where Markdown-to-PDF conversion is automated or exposed to user-supplied content.
Jun 29, 2026
Microsoft released a security update for **Microsoft Edge (Chromium-based)** to remediate a high-severity remote code execution vulnerability tracked as **`CVE-2026-50521`**. According to the advisory, the flaw carries a **CVSS score of 8.3** and could allow a remote attacker to execute arbitrary code over a network. The vulnerability was described as having **low attack complexity**, requiring **low privileges** and **no user interaction**, increasing the urgency for enterprise remediation. Microsoft documented the fix in its Edge security release notes, and external defenders including **EG-FinCIRT** urged organizations to deploy the update promptly after standard testing to reduce exposure.
Jul 14, 2026
Microsoft published security advisories for a broad set of **denial-of-service** vulnerabilities affecting Windows components and related software, including **IP Helper** (`CVE-2025-21231`), **Windows Virtual Trusted Platform Module** (`CVE-2025-21280`), **Windows Remote Desktop Services** (`CVE-2025-21330`), **DHCP Client Service** (`CVE-2025-21179`), **Windows Active Directory Domain Services API** (`CVE-2025-21351`), **Windows Hyper-V** (`CVE-2025-62567`), **Windows Kerberos** (`CVE-2022-41053`), and **Microsoft Defender** (`CVE-2023-36010`). The disclosures indicate continued exposure of core enterprise infrastructure services to attacks that can disrupt availability without necessarily compromising data or system integrity. Microsoft also issued an advisory for **Prometheus** remote read endpoint vulnerability `CVE-2026-42154`, describing a remotely exploitable flaw caused by a crafted **snappy** payload that can trigger uncontrolled resource consumption. Microsoft rated the issue **CVSS 7.5** and said it requires **no privileges** and **no user interaction**, with impact focused on sustained or persistent service outages. Together, the advisories highlight availability risks spanning identity, networking, virtualization, endpoint protection, remote access, and monitoring systems commonly deployed in enterprise environments.
Jun 29, 2026