GHSA-gphh-9q3h-jgpp: banks has Critical Remote Code Execution (RCE) via Jinja2 SSTI

Summary

banks versions up to and including 2.4.1 render prompt templates with an unsandboxed jinja2.Environment() in src/banks/env.py. Applications that pass user-supplied strings as the template argument to Prompt() are exposed to Server-Side Template Injection, which can lead to Remote Code Execution on the host.

Mitigation

Fixed in banks 2.4.2 (PR #74), which switches to jinja2.sandbox.SandboxedEnvironment. Developers on banks <= 2.4.1 should upgrade to 2.4.2 and avoid passing untrusted user input as the template argument to Prompt().

Affected packages in the Exposure Registry

Matched by package name and ecosystem. Each entry shows whether the package delegates to a language model and how many tracked packages depend on it.

• banksPyPILLM dependency since 2023-06-04 · 2 tracked dependents

Related items

• MediumClaude Code's “Don't Ask Again” File Exposes Passwords and Keys in 1,122 Public Copies on GitHubSimilar attack · The Hacker News
• MediumCVE-2026-118046: JS Help Desk plugin stored DOM-based cross-site scripting via jsticket_messageSimilar attack · NVD/CVE Database
• MediumARTEX abuse expands as cybercriminals target financial sectorSimilar attack · Microsoft Security Blog
• MediumCVE-2026-102610: fast-agent serve unauthenticated remote command execution via /mcp endpointSimilar attack · NVD/CVE Database
• CriticalCVE-2026-58490: Tracecat SAML authentication bypass through unsigned responses in Docker ComposeSimilar attack · NVD/CVE Database