GHSA-64vx-6h2c-rjh7: Banks: Unsafe importlib.import_module of attacker-controlled Tool.import_path in CompletionExtension allows RCE

Summary

The banks package (2.4.2, latest per the report) resolves each Tool's import_path with importlib.import_module and getattr in src/banks/extensions/completion.py, with no allowlist or validation on the field. Tool JSON parsed from the rendered body of a {% completion %} block can name any importable attribute, such as os.system, and when the LLM emits a matching tool_calls entry the callable runs with arguments from the model output, giving arbitrary code execution in the banks-hosting process. The report states this is distinct from GHSA-gphh-9q3h-jgpp / CVE-2026-44209, whose 2.4.2 fix (switching env.py to SandboxedEnvironment) does not cover this path.

Mitigation

The source does not state a fix yet. Check the original advisory for updates.

Affected packages in the Exposure Registry

Matched by package name and ecosystem. Each entry shows whether the package delegates to a language model and how many tracked packages depend on it.

• banksPyPILLM dependency since 2023-06-04 · 2 tracked dependents

Related items

• MediumHacking on Autopilot: Inside ARTEX Cybercrime CampaignsSimilar attack · Check Point Research
• MediumCVE-2026-122160: myshell-ai AIlice HuggingFace Model Wrapper untrusted model loadingSimilar attack · NVD/CVE Database
• MediumCVE-2026-122159: Edge0-AI Audio8_TTS path traversal via slow_decode_models argumentSimilar attack · NVD/CVE Database
• MediumCVE-2026-122235: Jan workspace guard bypass allows file writes outside workspace via symlinksSimilar attack · NVD/CVE Database
• HighCVE-2026-122135: Mistral Vibe remote code execution via repository gpg.program settingSimilar attack · NVD/CVE Database