Open actionable advisories and recorded vendor fixes. This public package view has no inventory attached and cannot establish whether your deployment is affected. A vendor fix never resolves your finding; verify your installed version and the source guidance.
Open advisories
4 actionable advisories, newest first. Withdrawn advisories and news are excluded. Coverage is partial.
In banks.registries.DirectoryPromptRegistry, prompt file paths and the index file (index.json) do not refuse symbolic links. When a prompt directory contains or accepts untrusted files (e.g. unpacked archives, shared repositories, or multi-tenant folders), symbolic links pointing outside the registry root can be used to disclose arbitrary files via scan() / get() or overwrite arbitrary files via set() / save(). Details Following PR #77, DirectoryPromptRegistry validates path resolution for prompt names. However: 1. self.indexpath (index.json) is not checked for symbolic links. A symlink pointing to an external target (e.g. a configuration file) will be overwritten by save() upon reg.set(), or read via load(). 2. In scan(), discovered .jinja files are opened and indexed without checking if path.issymlink() or if the resolved path escapes the registry root. A symlink pointing to a sensitive file outside the root is read and indexed. 3. In set(), promptfile.writetext(...) is…
Recommended action: Upgrade to 2.5.1 or later, then redeploy and verify.A vendor fix does not resolve your finding until you verify it in your own systems.
Banks' Prompt.chatmessages() method parses every rendered output line as a potential ChatMessage JSON object. If attacker-controlled template data renders to JSON such as {"role":"system","content":"..."}, Banks returns it as a privileged system message instead of treating it as plain user-controlled text. Applications that render untrusted user input with Prompt.chatmessages() and pass the returned messages directly to an LLM provider may be vulnerable to chat role injection and prompt boundary bypass. Details The issue is in src/banks/prompt.py: The method first renders the template, then attempts to parse each rendered line as a ChatMessage. Because this parsing is applied to the final rendered output, user-controlled template variables can accidentally become trusted structured chat messages. The ChatMessage model also accepts any string as the role in src/banks/types.py: As a result, an attacker can provide rendered content that becomes a system, assistant, or tool…
Recommended action: Upgrade to 2.5.0 or later, then redeploy and verify.A vendor fix does not resolve your finding until you verify it in your own systems.
DirectoryPromptRegistry.set() interpolates the attacker-controllable Prompt.name into a Path expression with no canonicalization. An application that derives the prompt name from request data lets a caller write attacker-controlled bytes outside the configured registry directory. Details src/banks/registries/directory.py:44 Two failure modes: 1. Relative traversal. name="../victim/foo" resolves to <registry/../victim/foo.0.jinja — outside the configured root. 2. Absolute-path bypass. pathlib documents that Path("/a") / Path("/b") returns Path("/b"). So name="/abs/path" discards the registry root entirely; the registry is never consulted. The poisoned name is then persisted to index.json, so the out-of-root path keeps reconstructing on later load() calls (directory.py:135-141). With overwrite=True, existing files at the target path are replaced. Proof of Concept Output (verified on banks==2.4.2): testsandboxbaseline.py <img width="793" height="149" alt="Screenshot 2026-05-10…
Recommended action: Upgrade to 2.4.5 or later, then redeploy and verify.A vendor fix does not resolve your finding until you verify it in your own systems.
banks <= 2.4.1 uses jinja2.Environment() (unsandboxed) to render prompt templates. Applications that pass user-supplied strings as the template argument to Prompt() are vulnerable to Server-Side Template Injection (SSTI), which can lead to Remote Code Execution (RCE) on the host system. This is a vulnerability in how banks initializes its Jinja2 environment — not in Jinja2 itself. Vulnerable Code src/banks/env.py — the global Jinja2 environment is created without sandboxing: Attack Scenario An application that stores prompt templates in a database, accepts them via an API, or loads them from a user-supplied config file and passes them to Prompt() is vulnerable. For example: Proof of Concept Setup: PoC script: Confirmed output: python from banks import Prompt p = Prompt("{{ self.init.globals.builtins.import('os').popen('echo POC /tmp/rcebanksexec').read() }}") p.text() bash ls -l /tmp/rcebanksexec -rw-rw-r-- 1 ak ak 4 Apr 27 15:36 /tmp/rcebanksexec Impact Applications that…
Recommended action: Upgrade to 2.4.2 or later, then redeploy and verify.A vendor fix does not resolve your finding until you verify it in your own systems.