Junglewise Threat Intelligence

CVE-2026-44209: masci banks Remote Code Execution via SSTI in Prompt templates

CVE-2026-44209 · Severity: high · CVSS 7.5 · Published 2026-05-26

Executive brief

The banks library, used for managing prompt templates in AI applications, is vulnerable to a flaw that allows attackers to execute arbitrary commands on the underlying server. If an application allows users to provide or customize their own templates, an attacker could gain full control over the system, steal sensitive data, or disrupt operations. This issue is resolved by upgrading to version 2.4.2.

Technical details

The banks library (<= 2.4.1) initializes its Jinja2 environment using the standard `jinja2.Environment` instead of the `SandboxedEnvironment`. This lack of sandboxing allows an attacker to perform template injection if they can control the string passed to the `Prompt()` class. By using Jinja2 dunder attribute traversal (e.g., accessing `__globals__` or `__builtins__`), an attacker can escape the template context to execute arbitrary Python code or system commands via `os.popen`. The vulnerability is fixed in version 2.4.2 by migrating to `jinja2.sandbox.SandboxedEnvironment`.

Affected products

  • masci banks <= 2.4.1

Timeline

  • 2026-05-06: disclosed: Vulnerability published by masci/banks
  • 2026-05-08: advisory: GitHub Advisory GHSA-gphh-9q3h-jgpp published
  • 2026-05-26: other: NVD published CVE-2026-44209

References

Related threats