Vulnerability  ·  2026-07-31

Banks LLM Prompt Template Library - RCE via Tool import_path Resolution and Path Traversal in Media Filters

VulnerabilityHigh impactGlobalCVE-2026-61536
Because Banks is designed to render LLM-facing prompt templates, any application that allows even partially untrusted input into a template (e.g., RAG-retrieved content, user-supplied variables) could result in full remote code execution via the import_path mechanism, or silent disclosure of arbitrary server files via the media filters.
CVE-2026-61536: Banks parses Tool JSON objects from rendered {% completion %} block content and resolves their import_path field via importlib.import_module()+getattr() without restriction, allowing arbitrary code execution if an attacker controls template-rendered content. CVE-2026-62663: all four media filters accept untrusted file paths and pass them directly to open() without sanitization, enabling arbitrary file read.
Banks (Python LLM prompt template library) prior to 2.4.3 (CVE-2026-61536) and prior to 2.4.4 (CVE-2026-62663)
Upgrade to Banks 2.4.3 (import_path fix) and 2.4.4 (media filter path sanitization) per the GitHub security advisories.
GitHub Security Advisory GHSA-64vx-6h2c-rjh7GitHub Security Advisory GHSA-98rr-gvc9-3cjh
See this in the live feed Explore related AI security and governance findings — updated every morning.
Open the feed →