CVE-2026-61536
Full vulnerability record from the local CVENow database.
Description
Banks generates meaningful LLM prompts using a simple template language. In versions prior to 2.4.3, banks parses Tool JSON objects from the rendered body of {% completion %} blocks and later resolves their import_path field through importlib.import_module(...) + getattr(...) to obtain the callable that handles a tool call. There is no allowlist or sanitization on import_path, so any importable Python attribute (e.g. os.system, subprocess.getoutput) can be selected. When the LLM emits a tool_calls entry whose function.name matches the attacker-supplied tool name, the resolved callable is invoked with kwargs decoded from tool_call.function.arguments, yielding arbitrary code execution in the banks-hosting process. This is distinct from GHSA-gphh-9q3h-jgpp / CVE-2026-44209. That advisory was fixed in 2.4.2 by switching src/banks/env.py from Environment to SandboxedEnvironment. The fix does not touch src/banks/extensions/completion.py, and the unsafe import + getattr chain still executes on 2.4.2. The malicious Tool JSON is plain text in the rendered template body — it requires no Jinja attribute access, so the sandbox is irrelevant. This issue has been fixed in version 2.4.3.
View original CVE JSON
{
"id": "CVE-2026-61536",
"sourceIdentifier": "[email protected]",
"published": "2026-07-30T19:18:34.553",
"lastModified": "2026-10-23T22:10:00.160",
"vulnStatus": "Deferred",
"cveTags": [],
"descriptions": [
{
"lang": "en",
"value": "Banks generates meaningful LLM prompts using a simple template language. In versions prior to 2.4.3, banks parses Tool JSON objects from the rendered body of {% completion %} blocks and later resolves their import_path field through importlib.import_module(...) + getattr(...) to obtain the callable that handles a tool call. There is no allowlist or sanitization on import_path, so any importable Python attribute (e.g. os.system, subprocess.getoutput) can be selected. When the LLM emits a tool_calls entry whose function.name matches the attacker-supplied tool name, the resolved callable is invoked with kwargs decoded from tool_call.function.arguments, yielding arbitrary code execution in the banks-hosting process. This is distinct from GHSA-gphh-9q3h-jgpp / CVE-2026-44209. That advisory was fixed in 2.4.2 by switching src/banks/env.py from Environment to SandboxedEnvironment. The fix does not touch src/banks/extensions/completion.py, and the unsafe import + getattr chain still executes on 2.4.2. The malicious Tool JSON is plain text in the rendered template body — it requires no Jinja attribute access, so the sandbox is irrelevant. This issue has been fixed in version 2.4.3."
},
{
"lang": "es",
"value": "Banks genera prompts de LLM significativos utilizando un lenguaje de plantillas simple. En versiones anteriores a la 2.4.3, banks analiza objetos JSON de Tool del cuerpo renderizado de los bloques {% completion %} y posteriormente resuelve su campo import_path a través de importlib.import_module(...) + getattr(...) para obtener el invocable que maneja una llamada a herramienta. No hay una lista de permitidos (allowlist) ni sanitización en import_path, por lo que cualquier atributo Python importable (por ejemplo, os.system, subprocess.getoutput) puede ser seleccionado. Cuando el LLM emite una entrada tool_calls cuyo function.name coincide con el nombre de la herramienta proporcionado por el atacante, el invocable resuelto es invocado con kwargs decodificados de tool_call.function.arguments, produciendo ejecución de código arbitrario en el proceso que aloja banks. Esto es distinto de GHSA-gphh-9q3h-jgpp / CVE-2026-44209. Esa advertencia se corrigió en la 2.4.2 cambiando src/banks/env.py de Environment a SandboxedEnvironment. La corrección no afecta a src/banks/extensions/completion.py, y la cadena insegura de import + getattr todavía se ejecuta en la 2.4.2. El JSON de Tool malicioso es texto plano en el cuerpo de la plantilla renderizada - no requiere acceso a atributos de Jinja, por lo que el sandbox es irrelevante. Este problema ha sido corregido en la versión 2.4.3."
}
],
"affected": [
{
"source": "[email protected]",
"affectedData": [
{
"vendor": "masci",
"product": "banks",
"versions": [
{
"version": "< 2.4.3",
"status": "affected"
}
]
}
]
}
],
"metrics": {
"cvssMetricV31": [
{
"source": "[email protected]",
"type": "Secondary",
"cvssData": {
"version": "3.1",
"vectorString": "CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H",
"baseScore": 7.5,
"baseSeverity": "HIGH",
"attackVector": "NETWORK",
"attackComplexity": "HIGH",
"privilegesRequired": "LOW",
"userInteraction": "NONE",
"scope": "UNCHANGED",
"confidentialityImpact": "HIGH",
"integrityImpact": "HIGH",
"availabilityImpact": "HIGH"
},
"exploitabilityScore": 1.6,
"impactScore": 5.9
}
],
"ssvcV203": [
{
"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"ssvcData": {
"timestamp": "2026-07-31T23:00:33.742984Z",
"id": "CVE-2026-61536",
"options": [
{
"exploitation": "poc"
},
{
"automatable": "no"
},
{
"technicalImpact": "total"
}
],
"role": "CISA Coordinator",
"version": "2.0.3"
}
}
]
},
"weaknesses": [
{
"source": "[email protected]",
"type": "Secondary",
"description": [
{
"lang": "en",
"value": "CWE-94"
},
{
"lang": "en",
"value": "CWE-470"
}
]
}
],
"references": [
{
"url": "https://github.com/masci/banks/security/advisories/GHSA-64vx-6h2c-rjh7",
"source": "[email protected]"
},
{
"url": "https://github.com/masci/banks/security/advisories/GHSA-64vx-6h2c-rjh7",
"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0"
}
]
}