Executive brief
Banks is a Python library for managing prompt templates. An application that accepts user-supplied prompt names through an API and forwards them to the registry can be exploited to write arbitrary files anywhere the application process has write access. An authenticated attacker can plant malicious Jinja templates, clobber configuration files, or inject code into shared application directories, leading to template injection, configuration tampering, or cross-application compromise.
Technical details
The vulnerability is a classic path traversal flaw in src/banks/registries/directory.py:44. The DirectoryPromptRegistry.set() method concatenates the user-controlled Prompt.name directly into a Path expression without validation or canonicalization: `prompt_file = path / f"{prompt.name}.{prompt.version}.jinja"`. This allows two attack vectors: (1) relative traversal using "../" sequences to escape the registry root, and (2) absolute path bypass where pathlib's `/` operator silently discards the left operand when the right is an absolute path. The poisoned name is persisted to index.json, so the escaping path reconstructs on subsequent _load() calls. The suggested fix involves strict allowlist validation (alphanumeric, dots, hyphens, underscores only) and post-canonicalization path containment checks. Fix available in v2.4.5.
Affected products
- masci banks < 2.4.5
Timeline
- 2026-08-07: disclosed
- 2026-08-20: patched: v2.4.5 released
- 2026-09-02: advisory