CVE-2026-53597 Root-Cause Patch Review for prompty gray-matter RCE

Vulnerability

CVE-2026-53597 describes unauthenticated remote code execution in Microsoft prompty when parsing attacker-controlled .prompty files. The vulnerable code path in runtime/typescript/packages/core/src/core/loader.ts called matter(raw) directly, which allowed gray-matter language-specific frontmatter handling to process executable JavaScript frontmatter blocks. In this context, a malicious file using ---js or ---javascript frontmatter could cause evaluation during parsing rather than being treated as inert metadata.

The commit referenced by the vendor-facing code change is c27402da2487075be577f06aa79df627fb9d6853. The CVE context is also reflected in the CVE record. The supplied test case demonstrates the practical exploit model: a crafted frontmatter block attempts require("node:fs").writeFileSync(...) during load, which is a direct integrity and code-execution impact.

const { data, content } = matter(raw);

That single call is the security boundary failure shown in the diff: untrusted input was handed to a parser configuration that still permitted executable frontmatter engines.

Patch

The patch changes the loader to explicitly override gray-matter engines for JavaScript-tagged frontmatter and replace parsing with a hard failure. Instead of relying on default behavior, the loader now supplies an engines map for js and javascript, both bound to a local function that always throws.

const { data, content } = matter(raw, {
  engines: {
    js: { parse: rejectExecutableFrontmatter },
    javascript: { parse: rejectExecutableFrontmatter },
  },
});
function rejectExecutableFrontmatter(): never {
  throw new Error("JavaScript frontmatter is not supported in .prompty files");
}

This is reinforced by a regression test added in runtime/typescript/packages/core/tests/loader.test.ts. The test writes a malicious .prompty file containing ---js frontmatter that would create a marker file if evaluated. It then asserts both that load(prompt) throws and that the marker file does not exist. That is important because it validates not only rejection semantics but also non-execution semantics.

The remaining package changes are version bumps from 2.0.0-beta.2 to 2.0.0-beta.3 across the monorepo packages, indicating the fix is being shipped consistently in the TypeScript runtime packages referenced by the commit here.

Review

Pros

• The patch directly addresses the dangerous feature boundary: executable frontmatter parsing in the loader. It does not merely sanitize payload strings after parsing.
• The fix is fail-closed for the known exploit languages by making js and javascript frontmatter unconditionally unsupported.
• The regression test is strong and security-relevant. It verifies absence of side effects, not just exception text.
• The change is low-complexity and localized to the parsing call site, reducing the chance of introducing unrelated behavior regressions.
• The explicit error message improves diagnosability for developers who may have relied on unsupported executable metadata.

Cons

• The patch shown is narrowly scoped to js and javascript engine names. Based only on the provided diff, there is no broader hardening against any other executable or custom engine aliases that gray-matter might accept if introduced elsewhere.
• The reviewable evidence covers the TypeScript loader path only. If prompty has other loaders, wrappers, or language runtimes that parse .prompty frontmatter independently, this commit does not demonstrate equivalent remediation there.
• The test covers one malicious payload and one engine tag. Additional regression cases for ---javascript and malformed frontmatter variants would improve confidence.
• The patch rejects executable frontmatter rather than replacing it with a safer declarative subset. That is appropriate for security, but it may be a breaking change for any consumers who intentionally used JS frontmatter.

Verdict

Root-cause.

The vulnerable behavior was the loader permitting gray-matter to process executable JavaScript frontmatter from untrusted .prompty input. The patch removes that capability at the parser configuration boundary by overriding the relevant engines to throw before evaluation can occur. The added test specifically proves the critical property: attacker-supplied frontmatter is not executed. Given the supplied sources, this is a technically sound fix for the documented attack path in CVE-2026-53597 and the code change in the upstream commit.

Residual risk remains only in areas not evidenced by this diff, such as alternate parsing entry points or other runtimes. For the patched TypeScript loader itself, the remediation appears complete and correctly targeted.