Executive brief
Banks is a library used to generate prompts for Large Language Models (LLMs) using a template language. A vulnerability exists where the library incorrectly trusts instructions within a template to load and execute any Python function on the host server. If an attacker can influence the content of a template—such as through a shared database or file system—they can execute arbitrary code, potentially leading to a full system takeover or data breach.
Technical details
In Banks versions prior to 2.4.3, the CompletionExtension parses Tool JSON objects directly from the rendered body of {% completion %} blocks. The library uses the 'import_path' field from this JSON to resolve a callable via importlib.import_module() and getattr() without any allowlist or sanitization. An attacker who can provide a malicious template can specify dangerous Python functions (e.g., 'os.system') in the 'import_path'. When the LLM triggers a tool call matching the attacker-defined tool name, the library executes the specified function with attacker-controlled arguments. This bypasses previous sandboxing efforts (CVE-2026-44209) because the vulnerability exists in the Python-level tool resolution logic rather than the Jinja2 template environment.
Affected products
- masci banks < 2.4.3
Timeline
- 2026-06-26: advisory: GitHub Security Advisory GHSA-64vx-6h2c-rjh7 published
- 2026-07-30: disclosed: CVE-2026-61536 assigned
- 2026-07-30: patched: Fixed in version 2.4.3