PatchSiren

PatchSiren cyber security CVE debrief

CVE-2026-61536 masci CVE debrief

Banks generates meaningful LLM prompts using a simple template language. In versions prior to 2.4.3, banks parses Tool JSON objects from the rendered body of {% completion %} blocks and later resolves their import_path field through importlib.import_module(...) + getattr(...) to obtain the callable that handles a tool call. There is no allowlist or sanitization on import_path, so any importable Python attribute (e.g. os.system, subprocess.getoutput) can be selected. When the LLM emits a tool_calls entry whose function.name matches the attacker-supplied tool name, the resolved callable is invoked with kwargs decoded from tool_calls.function.arguments, yielding arbitrary code execution in the banks-hosting process. This is distinct from GHSA-gphh-9q3h-jgpp / CVE-2026-44209. That advisory was fixed in 2.4.2 by switching src/banks/env.py from Environment to SandboxedEnvironment. The fix does not touch src/banks/extensions/completion.py, and the unsafe import + getattr chain still executes on 2.4.2. The malicious Tool JSON is plain text in the rendered template body — it requires no Jinja attribute access, so the sandbox is irrelevant. This issue has been fixed in version 2.4.3. Affected users should upgrade to version 2.4.3 or later and review and restrict import paths for Tool JSON objects.

Vendor
masci
Product
banks
CVSS
HIGH 7.5
CISA KEV
Not listed in stored evidence
Original CVE published
2026-07-30
Original CVE updated
2026-07-31
Advisory published
2026-07-30
Advisory updated
2026-07-31

Who should care

Users of banks versions prior to 2.4.3 should be aware of this vulnerability and take steps to mitigate it. This includes reviewing compensating controls for exposed systems while remediation is scheduled and verified, checking relevant monitoring, detection, and logs for exposed assets that need extra review, and tracking exceptions, retesting remediated assets, and closing the item only after evidence is documented. Additionally, operators, platforms, vulnerability-management, and security teams should assess their exposure and plan vendor-supported updates or mitigations through normal change control where exposure is confirmed. They should also confirm whether affected product deployments exist in managed environments and assign an owner for follow-up. Finally, they should review the supplied official advisory or CVE record to validate affected scope, severity, and vendor guidance. This CVE record was published on 2026-07-30T19:18:34.553Z and has not been modified since then, so users should rely on this information for their risk assessment and mitigation planning. Users should also consider the CVSS score of 7.5 and the HIGH severity rating when prioritizing their remediation efforts. The CVE description and NVD detail provide further context on the vulnerability and its potential impact. Users should also verify that their systems are not exposed to this vulnerability by checking their current version of banks and assessing their configurations. If they are exposed, they should prioritize remediation based on their risk assessment and change management processes. Finally, users should monitor for any additional information that may be disclosed in the future regarding this vulnerability and adjust their mitigation strategies accordingly. Users can also review the source item URL for more information on this vulnerability. The CVE record and NVD detail provide further information on this vulnerability, and users should review these sources to ensure they have a comprehensive understanding of the issue. The official CVE record and NVD detail provide the most up-to-date information on this vulnerability, and users should rely on these sources for their risk.

Technical summary

Banks generates meaningful LLM prompts using a simple template language. In versions prior to 2.4.3, banks parses Tool JSON objects from the rendered body of {% completion %} blocks and later resolves their import_path field through importlib.import_module(...) + getattr(...) to obtain the callable that handles a tool call. There is no allowlist or sanitization on import_path, so any importable Python attribute can be selected.

Defensive priority

CVE-2026-61536 is rated HIGH with a CVSS score of 7.5. Banks versions prior to 2.4.3 are vulnerable to arbitrary code execution due to lack of sanitization on import_path in Tool JSON objects.

Recommended defensive actions

  • Upgrade banks to version 2.4.3 or later
  • Review and restrict import paths for Tool JSON objects
  • Implement allowlisting or sanitization for import_path fields
  • Confirm whether affected product deployments exist in managed environments and assign an owner for follow-up.
  • Review the supplied official advisory or CVE record to validate affected scope, severity, and vendor guidance.
  • Plan vendor-supported updates or mitigations through normal change control where exposure is confirmed.
  • Check relevant monitoring, detection, and logs for exposed assets that need extra review.

Evidence notes

The CVE description states that banks generates meaningful LLM prompts using a simple template language and that in versions prior to 2.4.3, it parses Tool JSON objects from the rendered body of {% completion %} blocks. The import_path field is resolved through importlib.import_module(...) + getattr(...) without allowlisting or sanitization, allowing any importable Python attribute to be selected.

Official resources

AI-assisted PatchSiren debrief based on the supplied source corpus. The CVE record was published on 2026-07-30T19:18:34.553Z and has not been modified since then.