Banks: Prompt Injection via User-Controlled Chat Messages

A vulnerability in Banks' Prompt.chat_messages() method allows user-controlled template data to be parsed as privileged chat messages, enabling chat role injection attacks. Applications rendering untrusted user input with this method may be vulnerable to prompt boundary bypass.

Disclosed 8 October 2026 · Record updated 9 October 2026

Impact

Chat role injection vulnerability allowing attackers to inject system, assistant, or tool messages into LLM interactions when untrusted user input is rendered in prompt templates

Our coverage

A locked vault's security guard suddenly obeys commands whispered by a shadowy figure who rewrote the guard's instruction manual with forged credentials.

Vulnerabilities

Banks prompt library turns user text into system messages

A GitHub advisory published on 8 October 2026 says Banks' chat_messages() method can parse attacker-supplied JSON as privileged chat roles.

9 Oct 2026

Sources

github.comhttps://github.com/advisories/GHSA-hmq2-7hp6-7crh