CVE-2026-107717 · GHSA-hmq2-7hp6-7crh

Banks: User-controlled prompt input can be parsed as privileged chat messages

Risk score: 53/100
CVSS: 6.5 v3.1
Exploit chance (30 days): 0.3%
Published: 8 Oct 2026

Open in the live forecast Today's forecast

What to know

What it is: Banks generates meaningful LLM prompts using a simple template language. Prior to 2.5.0, Banks Prompt.chat_messages() attempts to parse every line of rendered template output as ChatMessage JSON. When an application renders untrusted data and passes the returned ChatMessage objects to an LLM provider, attacker-control…
Affected: banks (pip) <= 2.4.5
Fix: Upgrade banks to 2.5.0 or later.
Exploitation: Public proof of concept

Story map

Story map: the flaws, the fix, how it unfolded and what it connects to. Boxes link to the record or article.

At a glance

banks: Yellow, plan it in. Banks generates meaningful LLM prompts using a simple template language. Prior to 2.5.1, Banks DirectoryPromptRegistry does not reject symbolic links for index.json or discovered and existing .jinja prompt files. In an application where untrusted users can influence a prompt directory, DirectoryPromptRegistry._scan() …

The flaws

CVE-2026-107717: Banks: User-controlled prompt input can be parsed as privileged chat messages (CVSS 6.5 · EPSS 0%)
CVE-2026-107716: Banks: Symlink traversal and arbitrary file disclosure/overwrite in DirectoryPromptRegistry (CVSS 7.3 · EPSS 0%)

The fix

Upgrade banks: 2.5.0 · 2.5.1 or later on your release line

Who is exposed: banks (pip) <= 2.5.0

Where it stands

Public proof of concept

Connects to

Same weakness: Path traversal (CWE-22). 399 other warnings in 30 days

Why it is Yellow

CVSS 6.5 medium
Public exploit or proof of concept referenced
On your watchlist: PyPI

Affected packages

Package	Ecosystem	Vulnerable	Fixed in
banks	pip	<= 2.4.5	2.5.0

References

Original description

Banks generates meaningful LLM prompts using a simple template language. Prior to 2.5.0, Banks Prompt.chat_messages() attempts to parse every line of rendered template output as ChatMessage JSON. When an application renders untrusted data and passes the returned ChatMessage objects to an LLM provider, attacker-controlled JSON can cross the prompt boundary and become a system, assistant, or tool message because ChatMessage.role accepts arbitrary strings. This can override application instructions, alter the intended prompt structure, or confuse downstream tool and message handling. This issue is fixed in version 2.5.0.

Last activity 8 Oct 2026. Patch Forecast updates every hour.