{"description":"Trending threats, MITRE ATT\u0026CK coverage, and detection metadata. Fed continuously.","favicon":"https://feed.craftedsignal.io/favicon-32x32.png","feed_url":"https://feed.craftedsignal.io/vendors/banks/feed.json","home_page_url":"https://feed.craftedsignal.io/","icon":"https://feed.craftedsignal.io/apple-touch-icon.png","items":[{"_cs_actors":[],"_cs_cpes":["cpe:2.3:a:banks:banks:*:*:*:*:*:*:*:*"],"_cs_cves":[{"cvss":7.5,"id":"CVE-2026-61536"}],"_cs_exploited":false,"_cs_has_poc":false,"_cs_poc_references":[],"_cs_products":["banks (\u003c= 2.4.2)"],"_cs_severities":["high"],"_cs_tags":["rce","python","vulnerability"],"_cs_type":"advisory","_cs_vendors":["banks"],"content_html":"\u003cp\u003eThe banks library contains a vulnerability in its completion extension where tool definitions are parsed directly from template bodies without validation. An attacker can inject a JSON-serialized \u003ccode\u003eTool\u003c/code\u003e object into a template, specifying an arbitrary \u003ccode\u003eimport_path\u003c/code\u003e. When the application processes the template, \u003ccode\u003eimportlib.import_module\u003c/code\u003e is invoked on the attacker-controlled path, allowing the instantiation of any available Python callable. This enables remote code execution (RCE) with the privileges of the host process. This vulnerability persists in version 2.4.2 despite previous fixes for Jinja sandboxing, as the tool resolution logic operates outside the sandboxed environment.\u003c/p\u003e\n\u003ch2 id=\"attack-chain\"\u003eAttack Chain\u003c/h2\u003e\n\u003col\u003e\n\u003cli\u003eAttacker gains write access to a prompt registry (e.g., RedisPromptRegistry or shared filesystem).\u003c/li\u003e\n\u003cli\u003eAttacker injects a malicious \u003ccode\u003e{% completion %}\u003c/code\u003e block containing a JSON-serialized \u003ccode\u003eTool\u003c/code\u003e object.\u003c/li\u003e\n\u003cli\u003eThe malicious \u003ccode\u003eTool\u003c/code\u003e object specifies a high-risk \u003ccode\u003eimport_path\u003c/code\u003e (e.g., \u003ccode\u003eos.system\u003c/code\u003e).\u003c/li\u003e\n\u003cli\u003eThe application renders the template and calls \u003ccode\u003eTool.model_validate_json()\u003c/code\u003e to parse the injected JSON.\u003c/li\u003e\n\u003cli\u003eThe library calls \u003ccode\u003e_get_tool_callable\u003c/code\u003e, passing the untrusted \u003ccode\u003eimport_path\u003c/code\u003e to \u003ccode\u003eimportlib.import_module\u003c/code\u003e.\u003c/li\u003e\n\u003cli\u003eThe LLM is invoked or prompted to call the function name defined in the malicious tool.\u003c/li\u003e\n\u003cli\u003eThe application resolves the callable via \u003ccode\u003egetattr()\u003c/code\u003e and executes it with attacker-supplied arguments.\u003c/li\u003e\n\u003cli\u003eArbitrary command execution occurs under the application process context.\u003c/li\u003e\n\u003c/ol\u003e\n\u003ch2 id=\"impact\"\u003eImpact\u003c/h2\u003e\n\u003cp\u003eSuccessful exploitation allows for arbitrary code execution on the server hosting the banks-based application. This impact is significant for environments where prompts are fetched from external or shared sources, potentially leading to full system compromise depending on the process permissions.\u003c/p\u003e\n\u003ch2 id=\"recommendation\"\u003eRecommendation\u003c/h2\u003e\n\u003cul\u003e\n\u003cli\u003eUpgrade or migrate away from vulnerable implementations using the affected \u003ccode\u003eCompletionExtension\u003c/code\u003e until a vendor-supplied security patch is released.\u003c/li\u003e\n\u003cli\u003eImplement a hardcoded allowlist for tool callables at the application level to replace the dynamic \u003ccode\u003eimportlib\u003c/code\u003e resolution.\u003c/li\u003e\n\u003cli\u003eAudit all prompt storage mechanisms (Redis, file-based registries) to ensure only authorized users can modify template content.\u003c/li\u003e\n\u003cli\u003eRestrict process-level permissions for inference services to limit the impact of potential RCE.\u003c/li\u003e\n\u003c/ul\u003e\n","date_modified":"2026-11-05T22:30:30Z","date_published":"2026-11-05T22:30:30Z","id":"https://feed.craftedsignal.io/briefs/2026-11-banks-rce/","summary":"The banks library fails to validate tool import paths parsed from template content, allowing an attacker to achieve arbitrary code execution by defining malicious Tool objects that resolve to system-level Python callables.","title":"Banks: Arbitrary import path resolution remote code execution (CVE-2026-61536)","url":"https://feed.craftedsignal.io/briefs/2026-11-banks-rce/"}],"language":"en","title":"CraftedSignal Threat Feed - Banks","version":"https://jsonfeed.org/version/1.1"}