Multiple security vulnerabilities have been identified in banks, a Python package for LLM completion workflows. The issues affect the completion extension and template processing components, allowing attacker-influenced template content to reach unsafe code-resolution logic. Affected versions are reported as banks up to and including 2.4.2. The overall risk is high because a remote attacker who can influence prompt content may achieve arbitrary code execution in the hosting process.
CVE-2026-61536 (CVSS 7.5 — High): The completion extension parses tool definitions from rendered template content and resolves an attacker-controlled import path to a Python callable without an allowlist. A remote attacker who can influence prompt or template content can cause the application to import and invoke arbitrary code, leading to remote code execution in the banks-hosting process.[/subscribe_to_unlock_form]
Multiple security vulnerabilities have been identified in banks, a Python package for LLM completion workflows. The issues affect the completion extension and template processing components, allowing attacker-influenced template content to reach unsafe code-resolution logic. Affected versions are reported as banks up to and including 2.4.2. The overall risk is high because a remote attacker who can influence prompt content may achieve arbitrary code execution in the hosting process.
CVE-2026-61536 (CVSS 7.5 — High): The completion extension parses tool definitions from rendered template content and resolves an attacker-controlled import path to a Python callable without an allowlist. A remote attacker who can influence prompt or template content can cause the application to import and invoke arbitrary code, leading to remote code execution in the banks-hosting process.[emaillocker id="1283"]
CVE-2026-44209: The template-processing component in banks allowed unsafe attribute access in the rendering environment, so template content could reach sensitive Python functionality. An attacker who can influence template content could potentially exploit this to access unintended functionality.
These vulnerabilities collectively present a high risk of remote code execution for deployments that process attacker-influenced prompts or template content. Organizations that expose banks-based completion workflows to untrusted input are most at risk. The general action is to reduce exposure by limiting who can influence prompt content and by treating template and tool input as untrusted.
We recommend you to update banks to version 2.4.3.
The following reports contain further technical details:
[/emaillocker]