EUVD-2026-51246Severity by source
AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H
Network-reachable but gated on attacker-influenced tool definitions (PR:L) and the LLM emitting a matching tool_call (AC:H); arbitrary code execution yields full C:H/I:H/A:H.
Primary rating from Vendor (GitHub_M).
CVSS VectorVendor: GitHub_M
Lifecycle Timeline
3DescriptionCVE.org
Banks generates meaningful LLM prompts using a simple template language. In versions prior to 2.4.3, banks parses Tool JSON objects from the rendered body of {% completion %} blocks and later resolves their import_path field through importlib.import_module(...) + getattr(...) to obtain the callable that handles a tool call. There is no allowlist or sanitization on import_path, so any importable Python attribute (e.g. os.system, subprocess.getoutput) can be selected. When the LLM emits a tool_calls entry whose function.name matches the attacker-supplied tool name, the resolved callable is invoked with kwargs decoded from tool_call.function.arguments, yielding arbitrary code execution in the banks-hosting process. This is distinct from GHSA-gphh-9q3h-jgpp / CVE-2026-44209. That advisory was fixed in 2.4.2 by switching src/banks/env.py from Environment to SandboxedEnvironment. The fix does not touch src/banks/extensions/completion.py, and the unsafe import + getattr chain still executes on 2.4.2. The malicious Tool JSON is plain text in the rendered template body - it requires no Jinja attribute access, so the sandbox is irrelevant. This issue has been fixed in version 2.4.3.
Articles & Coverage 1
AnalysisAI
Arbitrary code execution in the Banks Python LLM-templating library (versions prior to 2.4.3) allows an attacker who can influence Tool JSON definitions within a {% completion %} block to run any importable Python callable in the host process. Banks resolves the attacker-controlled import_path field via importlib.import_module() plus getattr() with no allowlist, so values like os.system or subprocess.getoutput become invokable when the LLM emits a matching tool_calls entry, passing decoded arguments as kwargs. No public exploit identified at time of analysis; this bug is explicitly distinct from and unfixed by the 2.4.2 SandboxedEnvironment patch (GHSA-gphh-9q3h-jgpp / CVE-2026-44209) because the malicious payload is plain text in the rendered body and never touches Jinja attribute access.
Technical ContextAI
Banks is a Python library that builds LLM prompts using a Jinja-based template language, with a {% completion %} extension (src/banks/extensions/completion.py) that supports tool/function calling. The root cause is CWE-94 (Code Injection): after rendering, Banks parses Tool JSON objects from the completion block body and treats the JSON's import_path string as a fully-qualified Python attribute path, resolving it with importlib.import_module(module) followed by getattr(module, attr) to obtain the tool handler. Because there is no allowlist, deny-list, or namespace restriction on import_path, any importable attribute in the running interpreter - standard-library process-execution primitives included - can be selected as the 'tool' callable. The single affected package is identified by CPE cpe:2.3:a:masci:banks (the 'banks' project by author masci). Critically, the earlier 2.4.2 fix only swapped src/banks/env.py from Environment to SandboxedEnvironment to constrain Jinja sandbox escapes; it did not modify completion.py, and since the Tool JSON is literal text in the rendered output rather than a Jinja expression, the sandbox provides no protection against this vector.
RemediationAI
Upgrade Banks to version 2.4.3, which contains the fix for this issue (Vendor-released patch: 2.4.3); do not rely on 2.4.2, which patched the unrelated sandbox CVE-2026-44209 but left the unsafe import_path resolution in completion.py intact. See the advisory at https://github.com/masci/banks/security/advisories/GHSA-64vx-6h2c-rjh7. If immediate upgrade is not possible, apply compensating controls: treat all template and Tool JSON content as trusted-only and never render untrusted user/LLM-supplied data into {% completion %} blocks; if you maintain a fork or wrapper, enforce an allowlist restricting import_path to a small set of vetted, fully-qualified callables and reject any path resolving into os, subprocess, builtins, or similar process/eval modules (trade-off: legitimate dynamic tools must be pre-registered); and run the Banks-hosting process under a least-privilege, sandboxed account or container so that a successful callable invocation has minimal blast radius. These controls constrain but do not fully eliminate the flaw - the patched release remains the durable fix.
Wazuh SIEM platform versions 4.4.0 through 4.9.0 contain an unsafe deserialization vulnerability in the DistributedAPI t
BentoML version 1.4.2 and earlier contains an unauthenticated remote code execution vulnerability through insecure deser
pgAdmin 4 contains critical remote code execution vulnerabilities in the Query Tool download and Cloud Deployment endpoi
The renderLocalView function in render/views.py in graphite-web in Graphite 0.9.5 through 0.9.10 uses the pickle Python
BentoML is a Python library for building online serving systems optimized for AI apps and model inference. Rated critica
OpenSSL before 0.9.8za, 1.0.0 before 1.0.0m, and 1.0.1 before 1.0.1h does not properly restrict processing of ChangeCiph
pyLoad download manager version prior to 0.5.0b3.dev77 exposes the Flask SECRET_KEY through an unauthenticated endpoint.
Langflow (a visual LLM pipeline builder) contains a critical unauthenticated code execution vulnerability (CVE-2026-3301
In Mercurial before 4.1.3, "hg serve --stdio" allows remote authenticated users to launch the Python debugger, and conse
Unauthenticated remote code execution affects Kestra OSS (the open-source event-driven orchestration platform) prior to
Unauthenticated remote code execution in Marimo ≤0.20.4 allows attackers to execute arbitrary system commands via the `/
pyLoad is the free and open-source Download Manager written in pure Python. Rated medium severity (CVSS 5.3), this vulne
Same weakness CWE-94 – Code Injection
View allVendor StatusVendor
Share
External POC / Exploit Code
Leaving vuln.today