A critical vulnerability in the prompty and nunjucks libraries for Node.js enables remote code execution through attacker-controlled template files. The issue arises from unrestricted JavaScript member access in the Nunjucks renderer when processing .prompty files, a markdown-based format for LLM prompts. Versions prior to 0.1.5 and 2.0.0-beta.5 evaluate untrusted template bodies without sufficient safeguards, allowing malicious actors to traverse constructor and prototype properties to execute arbitrary JavaScript within the host Node.js process. This vulnerability affects applications using prompty versions below 0.1.5 or nunjucks versions below 2.0.0-beta.5. Successful exploitation could lead to full system compromise, data exfiltration, or service disruption. Immediate remediation is required for all affected deployments. Developers are strongly advised to upgrade to the fixed versions, which include input validation and sandboxing mitigations. Users should review their dependency trees for prompty or nunjucks usage and apply updates without delay. No known workarounds exist for this high-severity issue, which carries a CVSS score of 10.0.