{"id":"CVE-2026-107716","title":"Banks generates meaningful LLM prompts using a simple template language","summary":"Banks generates meaningful LLM prompts using a simple template language. Prior to 2.5.1, Banks DirectoryPromptRegistry does not reject symbolic links for index.json or discovered and existing .jinja prompt files. In an application where …","severity":"medium","cwe":["CWE-22","CWE-59"],"vendor":"banks","product":"banks","affected":["banks <= 2.5.0"],"patched":["banks 2.5.1"],"published":"2026-10-08","updated":"2026-10-09","sourceUpdated":"2026-10-09T16:17:23.310","source":"NVD","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-107716","references":[{"url":"https://github.com/masci/banks/commit/23ed13e50b4e217693fa5f9c30943fac8a41582f","label":"security-advisories@github.com"},{"url":"https://github.com/masci/banks/pull/79","label":"security-advisories@github.com"},{"url":"https://github.com/masci/banks/releases/tag/v2.5.1","label":"security-advisories@github.com"},{"url":"https://github.com/masci/banks/security/advisories/GHSA-556j-vv39-8rqv","label":"security-advisories@github.com"},{"url":"https://github.com/advisories/GHSA-556j-vv39-8rqv"},{"url":"https://github.com/masci/banks"},{"url":"https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-107716.json"},{"url":"https://access.redhat.com/security/cve/CVE-2026-107716"},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2548687"},{"url":"https://www.cve.org/CVERecord?id=CVE-2026-107716"},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-107716"},{"url":"https://pypi.org/project/banks"}],"tags":["nvd","ghsa","pip","osv","csaf","vex","red-hat","cve.org"],"aliases":["GHSA-556j-vv39-8rqv","PYSEC-2026-4201"],"ecosystem":"pip","ingestedAt":"2026-10-08T22:11:53.869Z","cvss":7.3,"cvssVector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:L","cvssSource":"vendor","epss":0.00134,"epssPercentile":0.02901,"ssvc":{"exploitation":"none","automatable":"no","technicalImpact":"partial","timestamp":"2026-10-09T14:54:57.852402Z"},"slug":"CVE-2026-107716","body":"## Overview\n\nBanks generates meaningful LLM prompts using a simple template language. Prior to 2.5.1, Banks DirectoryPromptRegistry does not reject symbolic links for index.json or discovered and existing .jinja prompt files. In an application where untrusted users can influence a prompt directory, DirectoryPromptRegistry._scan() and DirectoryPromptRegistry.get() can follow a link outside the registry root and disclose a file, while DirectoryPromptRegistry.set(), DirectoryPromptRegistry._save(), and DirectoryPromptRegistry._load() can read or overwrite an external link target. The issue requires attacker influence over the registry directory or its extracted contents. This issue is fixed in version 2.5.1.\n\n## Remediation\n\nRefer to the linked advisories for vendor-supplied fixes and affected version ranges.\n\n## Package advisory (CVE-2026-107716)\n\nAffected packages:\n\n- `banks <= 2.5.0`\n\nPatched in:\n\n- `banks 2.5.1`\n\nSource: https://github.com/advisories/GHSA-556j-vv39-8rqv\n\n## Vendor advisories\n\n- **Red Hat VEX** · Important · affected: Exploit Intelligence, Lightspeed Core, OpenShift Lightspeed, Red Hat Ansible Automation Platform 2 · no fix planned: Exploit Intelligence, Lightspeed Core, OpenShift Lightspeed, Red Hat Ansible Automation Platform 2 · updated 2026-10-15 · [vex](https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-107716.json)","depth":"sunlit","depthScore":40,"depthScoreParts":{"impact":40.2,"likelihood":0,"exploitation":0,"ransomware":0},"changes":[{"seq":218781,"id":"CVE-2026-107716","ts":1791620512794,"field":"cvss","old":null,"new":"7.3"}]}