Template Parsing Vulnerability in Banks Product by Masci
CVE-2026-107717

6.5MEDIUM

Key Information:

Vendor

Masci

Status
Banks
Vendor
CVE Published:
8 October 2026

What is CVE-2026-107717?

A vulnerability in the Banks product allows improper handling of ChatMessage JSON due to inadequate input validation. Specifically, the function Prompt.chat_messages() fails to correctly process template output before rendering it within the application. This oversight can lead to maliciously crafted JSON being executed, enabling attackers to manipulate the role of ChatMessage objects. If untrusted data is rendered and sent to a language model provider, this can compromise application functionality, alter user experiences, and significantly affect message handling processes. The issue is addressed in version 2.5.0.

Affected Version(s)

banks < 2.5.0

References

https://github.com/masci/banks/security/advisories/GHSA-h...
x_refsource_CONFIRM
https://github.com/masci/banks/pull/78
x_refsource_MISC
https://github.com/masci/banks/commit/02172b816fb84f6a824...
x_refsource_MISC

CVSS V3.1

Score:
6.5
Severity:
MEDIUM
Confidentiality:
Low
Integrity:
Low
Availability:
Low
Attack Vector:
Network
Attack Complexity:
Low
Privileges Required:
None
User Interaction:
None
Scope:
Unchanged

Timeline

  • Vulnerability published

  • Vulnerability Reserved

.