CVE-2026-22661 - Vulnerability Analysis

Overview

prompts.chat prior to commit 0f8d4c3 contains a path traversal vulnerability caused by unsanitized filenames in skill file ZIP archives, letting attackers write arbitrary files and achieve code execution, exploit requires crafted malicious ZIP files.

Severity & Score

Impact

Attackers can write arbitrary files and execute code by exploiting path traversal in skill file extraction.

Mitigation

Update to the version including commit 0f8d4c3 or later.

References

• https://github.com/f/prompts.chat/commit/0f8d4c381abd7b2d7478c9fdee9522149c2d65e5
• https://github.com/f/prompts.chat/pull/1101
• https://www.vulncheck.com/advisories/prompts-chat-path-traversal-via-skill-file-handling

Related Resources

• Vulnerability Intelligence Dashboard
• Credential Scanner