p PatchFirst

CVE-2026-107717

CVE-2026-107717 · Banks: User-controlled prompt input can be parsed as privileged chat messages

This page contains facts from public vulnerability sources. Check the original advisory before updating.

Banks generates meaningful LLM prompts using a simple template language. Prior to 2.5.0, Banks Prompt.chat_messages() attempts to parse every line of rendered template output as ChatMessage JSON. When an application renders untrusted data and passes the returned ChatMessage objects to an LLM provider, attacker-controlled JSON can cross the prompt boundary and become a system, assistant, or tool message because ChatMessage.role accepts arbitrary strings. This can override application instructions, alter the intended prompt structure, or confuse downstream tool and message handling. This issue is fixed in version 2.5.0.

CVSS 6.5 · Medium · EPSS 0.3% · Fix available

Published
Updated

Stack: python

Affected products and versions

  • banks

    Versions
    • < 2.5.0: Affected

    No fix published

  • banks PyPI

    Versions
    • 0.0.1
    • 0.0.2
    • 0.0.3
    • 0.1.0
    • 0.1.1
    • 0.2.0
    • 0.3.0
    • 0.3.1
    • 0.4.1
    • 0.5.0
    • 0.6.0
    • 1.0.0
    • 1.1.0
    • 1.2.0
    • 1.2.1
    • 1.3.0
    • 1.4.0
    • 1.5.0
    • 1.6.0
    • 1.6.1
    • 1.7.0
    • 1.7.1
    • 1.8.0
    • 2.0.0
    • 2.1.0
    • 2.1.1
    • 2.1.2
    • 2.1.3
    • 2.2.0
    • 2.3.0
    • 2.4.0
    • 2.4.1
    • 2.4.2
    • 2.4.3
    • 2.4.4
    • 2.4.5
    Affected ranges
    • ECOSYSTEM: < 2.5.0

    Update to 2.5.0

Original sources

Check your server →