CVE-2026-61536

Name of the Vulnerable Software and Affected Versions Banks versions prior to 2.4.3

Description Banks parses Tool JSON objects from the rendered body of {% completion %} blocks and resolves the import path field using importlib.import module(...) and getattr(...) to identify the callable for tool calls. Due to a lack of sanitization or an allowlist for the import path variable, any importable Python attribute, such as os.system or subprocess.getoutput, can be selected. If the LLM generates a tool calls entry where the function.name matches an attacker-supplied tool name, the resolved callable is executed with arguments decoded from tool call.function.arguments, leading to arbitrary code execution within the process hosting Banks.

Recommendations Update to version 2.4.3.