---
id: CVE-2026-107717
title: Banks generates meaningful LLM prompts using a simple template language
summary: >-
  Banks generates meaningful LLM prompts using a simple template language. Prior
  to 2.5.0, Banks Prompt.chat_messages() attempts to parse every line of
  rendered template output as ChatMessage JSON. When an application renders
  untrusted dat…
severity: medium
cvss: 6.5
cvssVector: 'CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N'
cwe:
  - CWE-20
  - CWE-501
vendor: banks
product: banks
affected:
  - banks <= 2.4.5
patched:
  - banks 2.5.0
published: '2026-10-08'
updated: '2026-10-13'
sourceUpdated: '2026-10-13T17:17:16.860'
source: NVD
sourceUrl: 'https://nvd.nist.gov/vuln/detail/CVE-2026-107717'
references:
  - url: >-
      https://github.com/masci/banks/commit/02172b816fb84f6a824cc09a8aca7416f53c12cb
    label: security-advisories@github.com
  - url: 'https://github.com/masci/banks/pull/78'
    label: security-advisories@github.com
  - url: 'https://github.com/masci/banks/releases/tag/v2.5.0'
    label: security-advisories@github.com
  - url: 'https://github.com/masci/banks/security/advisories/GHSA-hmq2-7hp6-7crh'
    label: security-advisories@github.com
  - url: 'https://github.com/masci/banks/security/advisories/GHSA-hmq2-7hp6-7crh'
    label: 134c704f-9b21-4f2e-91b3-4a467353bcc0
  - url: 'https://github.com/advisories/GHSA-hmq2-7hp6-7crh'
  - url: 'https://github.com/masci/banks'
  - url: >-
      https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-107717.json
  - url: 'https://access.redhat.com/security/cve/CVE-2026-107717'
  - url: 'https://bugzilla.redhat.com/show_bug.cgi?id=2550680'
  - url: 'https://www.cve.org/CVERecord?id=CVE-2026-107717'
  - url: 'https://nvd.nist.gov/vuln/detail/CVE-2026-107717'
  - url: 'https://pypi.org/project/banks'
tags:
  - nvd
  - ghsa
  - pip
  - osv
  - csaf
  - vex
  - red-hat
  - cve.org
  - exploit-available
epss: 0.00335
epssPercentile: 0.26764
aliases:
  - GHSA-hmq2-7hp6-7crh
  - PYSEC-2026-4202
ecosystem: pip
ingestedAt: '2026-10-08T22:11:53.870Z'
exploitAvailable: true
ssvc:
  exploitation: poc
  automatable: 'yes'
  technicalImpact: partial
  timestamp: '2026-10-13T16:15:40.228940Z'
---

## Overview

Banks generates meaningful LLM prompts using a simple template language. Prior to 2.5.0, Banks Prompt.chat_messages() attempts to parse every line of rendered template output as ChatMessage JSON. When an application renders untrusted data and passes the returned ChatMessage objects to an LLM provider, attacker-controlled JSON can cross the prompt boundary and become a system, assistant, or tool message because ChatMessage.role accepts arbitrary strings. This can override application instructions, alter the intended prompt structure, or confuse downstream tool and message handling. This issue is fixed in version 2.5.0.

## Remediation

Refer to the linked advisories for vendor-supplied fixes and affected version ranges.

## Package advisory (CVE-2026-107717)

Affected packages:

- `banks <= 2.4.5`

Patched in:

- `banks 2.5.0`

Source: https://github.com/advisories/GHSA-hmq2-7hp6-7crh

## Vendor advisories

- **Red Hat VEX** · Moderate · affected: Exploit Intelligence, Lightspeed Core, OpenShift Lightspeed, Red Hat Ansible Automation Platform 2 · no fix planned: Exploit Intelligence, Red Hat Ansible Automation Platform 2, Lightspeed Core, OpenShift Lightspeed · updated 2026-10-16 · [vex](https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-107717.json)