GitHub Advisoryadvisory · PyPI

GHSA-gphh-9q3h-jgpp banks has Critical Remote Code Execution (RCE) via Jinja2 SSTI

HIGH Published 2026-05-08 Modified 2026-06-08 Official page ↗
Aliases
CVE-2026-44209
Ecosystem
PyPI
Packages
banks
Severity
High
CVSS vector
CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H
Weaknesses
CWE-1336
Reviewed
2026-05-08

Affected packages

• PyPI banks: < 2.4.2 → fixed in 2.4.2

Description

Summary `banks /tmp/rce_banks_exec').read() }}") p.text() ``` ```bash ls -l /tmp/rce_banks_exec -rw-rw-r-- 1 ak ak 4 Apr 27 15:36 /tmp/rce_banks_exec ``` Impact Applications that allow end-users to supply or customize prompt templates are at risk of full Remote Code Execution, including arbitrary command execution, data exfiltration, and server compromise. Fix Fixed in `banks 2.4.2` (PR #74) by switching to `jinja2.sandbox.SandboxedEnvironment`, which blocks the dunder attribute traversal chain this exploit relies on. Developers on `banks <= 2.4.1` should upgrade to `2.4.2` and avoid passing untrusted user input as the template argument to `Prompt()`. Resources • Fix: https://github.com/masci/banks/pull/74 • CVE-2024-41950 (Haystack — identical root cause, CVSS 7.5) • CVE-2025-25362 (spacy-llm — identical root cause) • CWE-1336: Improper Neutralization of Special Elements in a Template Engine

Related

Alias · CVE (1)

  • CVE-2026-44209 Banks generates meaningful LLM prompts using a template language that makes sense. vulnerability

Weakness · CWE (1)

  • CWE-1336 Improper Neutralization of Special Elements Used in a Template Engine weakness

References