Why it matters
Because Banks is designed to render LLM-facing prompt templates, any application that allows even partially untrusted input into a template (e.g., RAG-retrieved content, user-supplied variables) could result in full remote code execution via the import_path mechanism, or silent disclosure of arbitrary server files via the media filters.
Attack vector
CVE-2026-61536: Banks parses Tool JSON objects from rendered {% completion %} block content and resolves their import_path field via importlib.import_module()+getattr() without restriction, allowing arbitrary code execution if an attacker controls template-rendered content. CVE-2026-62663: all four media filters accept untrusted file paths and pass them directly to open() without sanitization, enabling arbitrary file read.
Affected systems
Banks (Python LLM prompt template library) prior to 2.4.3 (CVE-2026-61536) and prior to 2.4.4 (CVE-2026-62663)
Mitigation
Upgrade to Banks 2.4.3 (import_path fix) and 2.4.4 (media filter path sanitization) per the GitHub security advisories.