CVE-2026-107717: Banks: User-controlled prompt input can be parsed as privileged chat messages

Banks’ Prompt.chat_messages() method parses every rendered output line as a potential ChatMessage JSON object. If attacker-controlled template data renders to JSON such as {"role":"system","content":"..."}, Banks returns it as a privileged system message instead of treating it as plain user-controlled text.

Applications that render untrusted user input with Prompt.chat_messages() and pass the returned messages directly to an LLM provider may be vulnerable to chat role injection and prompt boundary bypass.