Banks: Remote Code Execution via unsafe importlib in CompletionExtension

The Banks Python package (pip/banks) versions up to 2.4.2 contain a remote code execution vulnerability where unsafe importlib.import_module handling of attacker-controlled Tool.import_path allows arbitrary code execution when an LLM emits matching tool_calls. The vulnerability exists in CompletionExtension and bypasses the Jinja sandbox fix from CVE-2026-44209.

Disclosed 5 November 2026 · Record updated 5 November 2026

Impact

Arbitrary code execution in the banks-hosting process through malicious Tool JSON objects in rendered template bodies matched with LLM tool_calls.

Our coverage

A puppeteer's hand pulls strings attached to wooden figures, some painted as benign helpers, others revealing poisoned mechanisms beneath their surfaces.

Vulnerabilities

Banks prompt library flaw lets attackers run code via fake tools

A GitHub advisory published on 5 November 2026 says Banks versions up to 2.4.2 import any Python callable named in a template, including os.system.

5 Nov 2026

Sources

github.comhttps://github.com/advisories/GHSA-64vx-6h2c-rjh7