CVE-2026-107717 Banks: User-controlled prompt input can be parsed as privileged chat messages
Attackers can inject privileged chat messages via untrusted input, overriding LLM instructions and potentially executing code or bypassing security controls.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- Available
What is CVE-2026-107717?
CVE-2026-107717 is a medium-severity code injection vulnerability in masci banks, published on 8 Oct 2026. An attacker can exploit it over the internet without logging in, with no action from the victim.
Official description
Banks generates meaningful LLM prompts using a simple template language. Prior to 2.5.0, Banks Prompt.chat_messages() attempts to parse every line of rendered template output as ChatMessage JSON. When an application renders untrusted data and passes the returned ChatMessage objects to an LLM provider, attacker-controlled JSON can cross the prompt boundary and become a system, assistant, or tool message because ChatMessage.role accepts arbitrary strings. This can override application instructions, alter the intended prompt structure, or confuse downstream tool and message handling. This issue is fixed in version 2.5.0.
Weakness: CWE-20
Which versions are affected by CVE-2026-107717?
3 open source packages ship an affected version, including banks.
| Package | Affected | Fixed in |
|---|---|---|
banks PyPI | All versions | 2.5.0 |
banks PyPI | All versions | 2.5.0 |
banks PyPI | All versions | 2.5.0 |
How do I fix CVE-2026-107717?
Upgrade banks to 2.5.0 or later.
Upgrade, and never evaluate templates, expressions or code built from user input. More about Code injection.
Is CVE-2026-107717 being exploited?
It is not confirmed as exploited in the wild, but public exploit code for CVE-2026-107717 exists.
Sources
Also known as GHSA-hmq2-7hp6-7crh, PYSEC-2026-4202.