Executive brief
The banks library, used for managing prompt templates in AI applications, is vulnerable to a flaw that allows attackers to execute arbitrary commands on the underlying server. If an application allows users to provide or customize their own templates, an attacker could gain full control over the system, steal sensitive data, or disrupt operations. This issue is resolved by upgrading to version 2.4.2.
Technical details
The banks library (<= 2.4.1) initializes its Jinja2 environment using the standard `jinja2.Environment` instead of the `SandboxedEnvironment`. This lack of sandboxing allows an attacker to perform template injection if they can control the string passed to the `Prompt()` class. By using Jinja2 dunder attribute traversal (e.g., accessing `__globals__` or `__builtins__`), an attacker can escape the template context to execute arbitrary Python code or system commands via `os.popen`. The vulnerability is fixed in version 2.4.2 by migrating to `jinja2.sandbox.SandboxedEnvironment`.
Affected products
- masci banks <= 2.4.1
Timeline
- 2026-05-06: disclosed: Vulnerability published by masci/banks
- 2026-05-08: advisory: GitHub Advisory GHSA-gphh-9q3h-jgpp published
- 2026-05-26: other: NVD published CVE-2026-44209
References
- https://api.github.com/users/Anandakrishnasv
- https://github.com/Anandakrishnasv
- https://api.github.com/users/Anandakrishnasv/gists%7B/gist_id%7D
- https://api.github.com/users/Anandakrishnasv/repos
- https://avatars.githubusercontent.com/u/279425301?v=4
- https://api.github.com/users/Anandakrishnasv/events%7B/privacy%7D