Server-Side Template Injection Vulnerability in Banks by Masci
CVE-2026-44209

7.5HIGH

Key Information:

Vendor

Masci

Status
Banks
Vendor
CVE Published:
26 May 2026

What is CVE-2026-44209?

The Banks application prior to version 2.4.2 is susceptible to Server-Side Template Injection (SSTI) due to the use of jinja2.Environment() without sufficient sandboxing. This vulnerability arises when applications allow user-supplied strings as arguments for the template rendering process in the Prompt() function, potentially enabling attackers to execute remote code on the host system. This flaw has been addressed in version 2.4.2, which includes necessary security measures to mitigate the risk.

Affected Version(s)

banks < 2.4.2

References

https://github.com/masci/banks/security/advisories/GHSA-g...
x_refsource_CONFIRM
https://github.com/masci/banks/pull/74
x_refsource_MISC

CVSS V3.1

Score:
7.5
Severity:
HIGH
Confidentiality:
High
Integrity:
High
Availability:
High
Attack Vector:
Network
Attack Complexity:
High
Privileges Required:
None
User Interaction:
Required
Scope:
Unchanged

Timeline

  • Vulnerability published

  • Vulnerability Reserved

.