Banks: Arbitrary import path resolution remote code execution (CVE-2026-61536)

The banks library contains a vulnerability in its completion extension where tool definitions are parsed directly from template bodies without validation. An attacker can inject a JSON-serialized Tool object into a template, specifying an arbitrary import_path. When the application processes the template, importlib.import_module is invoked on the attacker-controlled path, allowing the instantiation of any available Python callable. This enables remote code execution (RCE) with the privileges of the host process. This vulnerability persists in version 2.4.2 despite previous fixes for Jinja sandboxing, as the tool resolution logic operates outside the sandboxed environment.

Attack Chain

1. Attacker gains write access to a prompt registry (e.g., RedisPromptRegistry or shared filesystem).
2. Attacker injects a malicious {% completion %} block containing a JSON-serialized Tool object.
3. The malicious Tool object specifies a high-risk import_path (e.g., os.system).
4. The application renders the template and calls Tool.model_validate_json() to parse the injected JSON.
5. The library calls _get_tool_callable, passing the untrusted import_path to importlib.import_module.
6. The LLM is invoked or prompted to call the function name defined in the malicious tool.
7. The application resolves the callable via getattr() and executes it with attacker-supplied arguments.
8. Arbitrary command execution occurs under the application process context.

Impact

Successful exploitation allows for arbitrary code execution on the server hosting the banks-based application. This impact is significant for environments where prompts are fetched from external or shared sources, potentially leading to full system compromise depending on the process permissions.

Recommendation

• Upgrade or migrate away from vulnerable implementations using the affected CompletionExtension until a vendor-supplied security patch is released.
• Implement a hardcoded allowlist for tool callables at the application level to replace the dynamic importlib resolution.
• Audit all prompt storage mechanisms (Redis, file-based registries) to ensure only authorized users can modify template content.
• Restrict process-level permissions for inference services to limit the impact of potential RCE.