EUVD-2026-51246Severity by source
AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H
Network-reachable but gated on attacker-influenced tool definitions (PR:L) and the LLM emitting a matching tool_call (AC:H); arbitrary code execution yields full C:H/I:H/A:H.
Primary rating from Vendor (GitHub_M).
CVSS VectorVendor: GitHub_M
CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H
Lifecycle Timeline
3DescriptionCVE.org
Banks generates meaningful LLM prompts using a simple template language. In versions prior to 2.4.3, banks parses Tool JSON objects from the rendered body of {% completion %} blocks and later resolves their import_path field through importlib.import_module(...) + getattr(...) to obtain the callable that handles a tool call. There is no allowlist or sanitization on import_path, so any importable Python attribute (e.g. os.system, subprocess.getoutput) can be selected. When the LLM emits a tool_calls entry whose function.name matches the attacker-supplied tool name, the resolved callable is invoked with kwargs decoded from tool_call.function.arguments, yielding arbitrary code execution in the banks-hosting process. This is distinct from GHSA-gphh-9q3h-jgpp / CVE-2026-44209. That advisory was fixed in 2.4.2 by switching src/banks/env.py from Environment to SandboxedEnvironment. The fix does not touch src/banks/extensions/completion.py, and the unsafe import + getattr chain still executes on 2.4.2. The malicious Tool JSON is plain text in the rendered template body - it requires no Jinja attribute access, so the sandbox is irrelevant. This issue has been fixed in version 2.4.3.
Articles & Coverage 1
AnalysisAI
Arbitrary code execution in the Banks Python LLM-templating library (versions prior to 2.4.3) allows an attacker who can influence Tool JSON definitions within a {% completion %} block to run any importable Python callable in the host process. Banks resolves the attacker-controlled import_path field via importlib.import_module() plus getattr() with no allowlist, so values like os.system or subprocess.getoutput become invokable when the LLM emits a matching tool_calls entry, passing decoded arguments as kwargs. …
Unlock full vulnerability intelligence
- Risk assessment & exploitation conditions
- Attack chain visualization
- Remediation with exact patch versions
- Threat intelligence from 22 sources
- Personal watchlist & email alerts
Free forever · No credit card required
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata
Vulnerability AssessmentAI
| Exploitation | Exploitation requires the attacker to control the import_path field of a Tool JSON object appearing in the rendered body of a {% completion %} block, and for the application to be using Banks' completion/tool-calling extension so that LLM tool_calls are resolved and invoked. … Additional conditions and limiting factors are described in the full assessment. |
| Risk Assessment | The provided CVSS 3.1 vector (AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H, base 7.5) reflects full confidentiality/integrity/availability impact (arbitrary code execution) tempered by high attack complexity and low-but-nonzero privileges - the attacker must be able to place a malicious Tool definition into the rendered template body AND rely on the LLM to emit a tool_calls entry whose function.name matches, a condition partly outside the attacker's direct control. … Full risk analysis with EPSS, KEV, and SSVC signal comparison available after sign-in. |
| Exploit Scenario | An attacker who can influence the content rendered into a completion block (for example via untrusted data that reaches the prompt template or tool definitions) inserts a Tool JSON object with import_path set to something like 'os.system' or 'subprocess.getoutput'. When the LLM subsequently returns a tool_calls entry whose function.name matches that tool, Banks resolves and invokes the attacker-chosen callable with attacker-decoded kwargs, achieving arbitrary command execution inside the application process. … |
| Remediation | Upgrade Banks to version 2.4.3, which contains the fix for this issue (Vendor-released patch: 2.4.3); do not rely on 2.4.2, which patched the unrelated sandbox CVE-2026-44209 but left the unsafe import_path resolution in completion.py intact. … Detailed patch versions, workarounds, and compensating controls in full report. |
Recommended ActionAI
Within 24 hours: Inventory all Banks library deployments and audit whether tool definition creation accepts input from untrusted sources (users, APIs, external systems); immediately restrict tool schema modification to trusted administrators only. …
Sign in for detailed remediation steps and compensating controls.
Threat intelligence, references, and detailed analysis are available after sign-in.
Wazuh SIEM platform versions 4.4.0 through 4.9.0 contain an unsafe deserialization vulnerability in the DistributedAPI t
BentoML version 1.4.2 and earlier contains an unauthenticated remote code execution vulnerability through insecure deser
pgAdmin 4 contains critical remote code execution vulnerabilities in the Query Tool download and Cloud Deployment endpoi
The renderLocalView function in render/views.py in graphite-web in Graphite 0.9.5 through 0.9.10 uses the pickle Python
BentoML is a Python library for building online serving systems optimized for AI apps and model inference. Rated critica
OpenSSL before 0.9.8za, 1.0.0 before 1.0.0m, and 1.0.1 before 1.0.1h does not properly restrict processing of ChangeCiph
pyLoad download manager version prior to 0.5.0b3.dev77 exposes the Flask SECRET_KEY through an unauthenticated endpoint.
In Mercurial before 4.1.3, "hg serve --stdio" allows remote authenticated users to launch the Python debugger, and conse
Unauthenticated remote code execution in Marimo ≤0.20.4 allows attackers to execute arbitrary system commands via the `/
pyLoad is the free and open-source Download Manager written in pure Python. Rated medium severity (CVSS 5.3), this vulne
Langflow (a visual LLM pipeline builder) contains a critical unauthenticated code execution vulnerability (CVE-2026-3301
Cross-user flow execution in Langflow (< 1.9.1) lets any authenticated API-key holder run another user's flow by passing
Same weakness CWE-94 – Code Injection
View allShare
External POC / Exploit Code
Leaving vuln.today