Advisories for Pypi/Banks package

banks parses Tool JSON objects from the rendered body of {% completion %} blocks and later resolves their import_path field through importlib.import_module(…) + getattr(…) to obtain the callable that handles a tool call. There is no allowlist or sanitization on import_path, so any importable Python attribute (e.g. os.system, subprocess.getoutput) can be selected. When the LLM emits a tool_calls entry whose function.name matches the attacker-supplied tool name, the resolved callable is …

Banks' Prompt.chat_messages() method parses every rendered output line as a potential ChatMessage JSON object. If attacker-controlled template data renders to JSON such as {"role":"system","content":"…"}, Banks returns it as a privileged system message instead of treating it as plain user-controlled text. Applications that render untrusted user input with Prompt.chat_messages() and pass the returned messages directly to an LLM provider may be vulnerable to chat role injection and prompt boundary bypass.

In banks.registries.DirectoryPromptRegistry, prompt file paths and the index file (index.json) do not refuse symbolic links. When a prompt directory contains or accepts untrusted files (e.g. unpacked archives, shared repositories, or multi-tenant folders), symbolic links pointing outside the registry root can be used to disclose arbitrary files via _scan() / get() or overwrite arbitrary files via set() / _save().

DirectoryPromptRegistry.set() interpolates the attacker-controllable Prompt.name into a Path expression with no canonicalization. An application that derives the prompt name from request data lets a caller write attacker-controlled bytes outside the configured registry directory.

banks <= 2.4.1 uses jinja2.Environment() (unsandboxed) to render prompt templates. Applications that pass user-supplied strings as the template argument to Prompt() are vulnerable to Server-Side Template Injection (SSTI), which can lead to Remote Code Execution (RCE) on the host system. This is a vulnerability in how banks initializes its Jinja2 environment — not in Jinja2 itself.