Executive brief
Banks is a Python library used to generate prompts for Large Language Models (LLMs) using a template language. In versions prior to 2.4.4, the library's media filters (image, audio, video, and document) do not properly check file paths provided by users. This allows an attacker to read sensitive files from the server's filesystem—such as configuration files, SSH keys, and cloud credentials—by including them in a prompt template.
Technical details
A path traversal vulnerability exists in the media filters (image, audio, video, and document) of the banks library. The root cause is located in the `from_path` methods within `types.py`, where user-supplied strings are converted to `Path` objects and passed directly to `open(file_path, "rb")` without sanitization or directory restriction. An attacker who can control template variables can use `../` sequences to escape intended directories and read any file accessible to the Python process. The contents of the accessed files are base64-encoded and embedded in the rendered prompt output, facilitating easy exfiltration. This issue is fixed in version 2.4.4.
Affected products
- masci banks < 2.4.4
Timeline
- 2026-07-07: advisory: GitHub Security Advisory published
- 2026-07-30: disclosed: CVE published to NVD
- 2026-07-30: patched: Fix released in version 2.4.4