What happened
Published 2026-08-20 (CVSS 6.0, Medium), this vulnerability lets attacker-controlled prompt name/version fields traverse outside the intended prompt-storage directory when using Banks' DirectoryPromptRegistry.
Why it matters
While a niche prompt-templating library, this shows the broader pattern of AI/LLM-tooling libraries lacking basic path-canonicalization hygiene when handling user- or agent-supplied identifiers, which can lead to arbitrary file write/overwrite in prompt-management pipelines.
Attack vector
DirectoryPromptRegistry.set() in src/banks/registries/directory.py interpolates attacker-controlled Prompt.name and Prompt.version values into a filesystem Path without canonicalization or containment validation, allowing path traversal when storing prompt templates.
Affected systems
Banks (LLM prompt template language) prior to 2.4.5
Mitigation
Upgrade to Banks ≥2.4.5; validate/canonicalize prompt name and version strings before path construction.