CVE-2026-61536 · GHSA-64vx-6h2c-rjh7

Banks: Unsafe importlib.import_module of attacker-controlled Tool.import_path in CompletionExtension allows RCE

Risk score: 56/100
CVSS: 7.5 v3.1
Exploit chance (30 days): 0.4%
Published: 30 Jul 2026

Open in the live forecast Today's forecast

What to know

What it is: Banks generates meaningful LLM prompts using a simple template language. In versions prior to 2.4.3, banks parses Tool JSON objects from the rendered body of {% completion %} blocks and later resolves their import_path field through importlib.import_module(...) + getattr(...) to obtain the callable that handles a tool…
Affected: banks (pip) <= 2.4.2
Fix: Upgrade banks to 2.4.3 or later.
Exploitation: No known exploitation

Story map

Story map: the flaws, the fix, how it unfolded and what it connects to. Boxes link to the record or article.

At a glance

banks: Yellow, plan it in. Banks generates meaningful LLM prompts using a simple template language. In versions prior to 2.4.3, banks parses Tool JSON objects from the rendered body of {% completion %} blocks and later resolves their import_path field through importlib.import_module(...) + getattr(...) to obtain the callable that handles a tool…

The flaws

CVE-2026-61536: Banks: Unsafe importlib.import_module of attacker-controlled Tool.import_path in CompletionExtension allows RCE (CVSS 7.5 · EPSS 0%)
CVE-2026-107716: Banks: Symlink traversal and arbitrary file disclosure/overwrite in DirectoryPromptRegistry (CVSS 7.3 · EPSS 0%)
CVE-2026-107717: Banks: User-controlled prompt input can be parsed as privileged chat messages (CVSS 6.5 · EPSS 0%)

The fix

Upgrade banks: 2.4.3 · 2.4.2 · 2.5.1 · 2.5.0 or later on your release line

Who is exposed: banks (pip) <= 2.4.2

Where it stands

Public proof of concept

Connects to

Same weakness: Code injection (CWE-94). 324 other warnings in 30 days

Why it is Yellow

CVSS 7.5 high
On your watchlist: PyPI

Affected packages

Package	Ecosystem	Vulnerable	Fixed in
banks	pip	<= 2.4.2	2.4.3

References

Original description

Banks generates meaningful LLM prompts using a simple template language. In versions prior to 2.4.3, banks parses Tool JSON objects from the rendered body of {% completion %} blocks and later resolves their import_path field through importlib.import_module(...) + getattr(...) to obtain the callable that handles a tool call. There is no allowlist or sanitization on import_path, so any importable Python attribute (e.g. os.system, subprocess.getoutput) can be selected. When the LLM emits a tool_calls entry whose function.name matches the attacker-supplied tool name, the resolved callable is invoked with kwargs decoded from tool_call.function.arguments, yielding arbitrary code execution in the banks-hosting process. This is distinct from GHSA-gphh-9q3h-jgpp / CVE-2026-44209. That advisory was fixed in 2.4.2 by switching src/banks/env.py from Environment to SandboxedEnvironment. The fix does not touch src/banks/extensions/completion.py, and the unsafe import + getattr chain still executes on 2.4.2. The malicious Tool JSON is plain text in the rendered template body — it requires no Jinja attribute access, so the sandbox is irrelevant. This issue has been fixed in version 2.4.3.

Last activity 5 Nov 2026. Patch Forecast updates every hour.