Banks CVE-2026-107717

Exploitation requires that the consuming application (1) renders attacker-controlled/untrusted data through a Banks template, (2) calls Prompt.chat_messages() on that rendered output, and (3) forwards the returned ChatMessage objects to an LLM provider. The decisive weakness is that chat_messages() parses every rendered line as ChatMessage JSON and ChatMessage.role accepts arbitrary string values, so an injected line can become a system, assistant, or tool message. LIMITING FACTORS: this is not exploitable against a default Banks install in isolation - it only manifests when untrusted input is deliberately templated into the chat-message pipeline; applications that template only trusted data, or that do not use chat_messages()/the chat extension, are not affected. Fixed in 2.5.0 via an environment sentinel so only intended chat blocks produce parseable messages.

This is a medium-severity (CVSS 6.5) input-validation flaw (CWE-20) in the Banks LLM prompt-templating library, and the signals point to a genuine-but-not-urgent issue rather than a fire. The CVSS vector (AV:N/AC:L/PR:N/UI:N) describes low-complexity, unauthenticated, remote reachability, but the impact is deliberately limited to C:L/I:L/A:N - reflecting prompt-structure manipulation (injecting system/assistant/tool messages), not code execution or data destruction. No EPSS score was provided in the input, so exploitation probability cannot be quantified here; this should be verified against the FIRST EPSS feed. There is no CISA KEV listing and no public exploit referenced, so exploitation status is: no public exploit identified at time of analysis. No SSVC decision record was supplied. The key tension is between the 'easy remote' CVSS metrics and the real precondition: the flaw only matters when an application deliberately renders attacker-controlled data through a Banks template and forwards the resulting ChatMessage objects to an LLM - this is an application-design-dependent path, not a default-on remote service, which materially lowers real-world risk below what the raw 6.5 implies for most deployments. Prioritize patching for applications that template untrusted user input into LLM prompts; deprioritize where templates only consume trusted data.

An application uses Banks to build LLM prompts and interpolates untrusted user input (e.g., a chat message or document) into a template. The attacker submits input containing a crafted line of ChatMessage JSON with role 'system' or 'tool'; because Prompt.chat_messages() parses every rendered line as ChatMessage JSON and ChatMessage.role accepts arbitrary strings, the injected object crosses the prompt boundary and is delivered to the LLM as a privileged message, overriding the application's instructions. No public proof-of-concept is referenced in the provided data.