EUVD-2026-63414
GHSA-x8wg-4xgc-vr54
Severity by source
CVSS:4.0/AV:N/AC:L/AT:P/PR:L/UI:N/VC:N/VI:H/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
AC:H maps the AT:P prerequisite (application must forward raw user input to Prompt fields); S:C reflects writes escaping the registry component boundary; PR:L captures required application-level authenticated access.
Primary rating from Vendor (GitHub_M).
CVSS VectorVendor: GitHub_M
Lifecycle Timeline
3DescriptionCVE.org
Banks generates meaningful LLM prompts using a simple template language. Prior to version 2.4.5, DirectoryPromptRegistry.set() in src/banks/registries/directory.py interpolates attacker-controlled Prompt.name and Prompt.version values into a Path without canonicalization or containment validation. Relative traversal such as ../victim/foo and an absolute Prompt.name can escape or discard the configured registry root, while overwrite=True permits replacement of existing target files. The poisoned name is persisted in index.json and reconstructed by _load(), allowing the out-of-root path to survive later registry loads. An application that forwards request data into these fields can therefore write Prompt.raw bytes to attacker-chosen paths writable by the application process. This issue is fixed in version 2.4.5.
AnalysisAI
Path traversal in the Banks Python prompt-template library (all versions prior to 2.4.5) allows a low-privileged attacker to write arbitrary bytes to attacker-chosen filesystem paths accessible to the application process. DirectoryPromptRegistry.set() in directory.py constructs on-disk paths by directly interpolating unvalidated Prompt.name and Prompt.version values - enabling relative sequences like ../victim/foo or absolute paths to escape the configured registry root. …
Unlock full vulnerability intelligence
- Risk assessment & exploitation conditions
- Attack chain visualization
- Remediation with exact patch versions
- Threat intelligence from 22 sources
- Personal watchlist & email alerts
Free forever · No credit card required
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata
Vulnerability AssessmentAI
| Exploitation | Exploitation requires three concurrent conditions: (1) the target application uses DirectoryPromptRegistry and directly incorporates externally-supplied, unvalidated values as Prompt.name or Prompt.version - this is an application-level design decision, not a default behavior of the library itself; (2) the attacker possesses at least low-privilege access to the interface that accepts these values (PR:L per CVSS 4.0 vector); and (3) the application process has write permission to files outside the registry root that the attacker wishes to target. … Additional conditions and limiting factors are described in the full assessment. |
| Risk Assessment | The CVSS 4.0 vector (AV:N/AC:L/AT:P/PR:L/UI:N/VC:N/VI:H/VA:N/SC:N/SI:N/SA:N, score 6.0) appropriately reflects the central limiting factor: AT:P (Attack Requirements: Present) encodes that the host application must directly expose externally-supplied data as Prompt.name or Prompt.version without its own sanitization - a specific architectural anti-pattern, not a universally-present attack surface. … Full risk analysis with EPSS, KEV, and SSVC signal comparison available after sign-in. |
| Exploit Scenario | Full exploit scenario with step-by-step reproduction available after sign-in. |
| Remediation | Upgrade to banks version 2.4.5 or later, which introduces the _resolve_prompt_file() validation helper and eliminates the traversal entirely; the patched release is available at https://github.com/masci/banks/releases/tag/v2.4.5 (fix commit: a215f6d779966945c56e0af5abed1ae5916fd9d3, PR #77). … Detailed patch versions, workarounds, and compensating controls in full report. |
Threat intelligence, references, and detailed analysis are available after sign-in.
Arbitrary code execution in the Banks Python LLM-templating library (versions prior to 2.4.3) allows an attacker who can
Arbitrary file disclosure in the Banks Python prompt-templating library (masci/banks) before 2.4.4 lets attackers who co
Same weakness CWE-22 – Path Traversal
View allSame technique Path Traversal
View allVendor StatusVendor
Share
External POC / Exploit Code
Leaving vuln.today