CVE-2026-22661 is a path traversal vulnerability in prompts.chat prior to commit 0f8d4c3. The issue arises from improper validation of filenames within skill file ZIP archives, allowing attackers to include path traversal sequences that cause files to be extracted outside the intended directory. This can lead to arbitrary file write on the client system, including overwriting shell initialization files, which may result in code execution. The vulnerability is remotely exploitable without privileges or user interaction beyond opening a crafted archive. It carries a CVSS 4.0 score of 8.6 (high severity). There is no vendor advisory or patch currently available.

Successful exploitation allows an attacker to write arbitrary files to the client system by exploiting path traversal sequences in skill file ZIP archives. This can lead to overwriting critical files such as shell initialization scripts, potentially resulting in arbitrary code execution. The vulnerability is remotely exploitable without authentication or privileges, posing a significant risk to affected users.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is released, users should avoid opening or importing skill file ZIP archives from untrusted sources. Monitor official prompts.chat channels for updates and apply any forthcoming patches promptly.