CVE-2026-107716
Severity not reportedBanks generates meaningful LLM prompts using a simple template language.
Banks generates meaningful LLM prompts using a simple template language. Prior to 2.5.1, Banks DirectoryPromptRegistry does not reject symbolic links for index.json or discovered and existing .jinja prompt files. In an application where untrusted users can influence a prompt directory, DirectoryPromptRegistry._scan() and DirectoryPromptRegistry.get() can follow a link outside the registry root and disclose a file, while DirectoryPromptRegistry.set(), DirectoryPromptRegistry._save(), and DirectoryPromptRegistry._load() can read or overwrite an external link target. The issue requires attacker influence over the registry directory or its extracted contents. This issue is fixed in version 2.5.1.
Affected products
Not reported by the source (unknown — not "none").
Weakness classification (CWE)
Source: NVD / CISA. “NVD-CWE-Other” and “NVD-CWE-noinfo” mean NVD could not assign a specific weakness.
Mitigation & advisories
No vendor advisory or patch reference tagged by NVD. Check the references below.
References
- https://github.com/masci/banks/commit/23ed13e50b4e217693fa5f9c30943fac8a41582f security-advisories@github.com
- https://github.com/masci/banks/pull/79 security-advisories@github.com
- https://github.com/masci/banks/releases/tag/v2.5.1 security-advisories@github.com
- https://github.com/masci/banks/security/advisories/GHSA-556j-vv39-8rqv security-advisories@github.com