Skip to content
OpenAdvisories

Vendor

masci

6 known vulnerabilities.

Products

banks 6
All Critical High Medium Low Exploited only Public exploit

2 results · Clear filters · Feed

  • Medium 6.5
    CVE-2026-107717

    Banks: User-controlled prompt input can be parsed as privileged chat messages

    Banks generates meaningful LLM prompts using a simple template language. Prior to 2.5.0, Banks Prompt.chat_messages() attempts to parse every line of rendered template output as ChatMessage JSON. When an application renders untrusted data and passes the retur…

    masci banks banks PyPI
  • Medium 6.0
    CVE-2026-71492

    Banks: Path traversal in `DirectoryPromptRegistry.set()` allows arbitrary file write outside the registry root

    Banks generates meaningful LLM prompts using a simple template language. Prior to version 2.4.5, DirectoryPromptRegistry.set() in src/banks/registries/directory.py interpolates attacker-controlled Prompt.name and Prompt.version values into a Path without cano…

    masci banks banks PyPI