CVE-2026-44209

Banks generates meaningful LLM prompts using a template language that makes sense. Prior to 2.4.2, banks uses jinja2.Environment() (unsandboxed) to render prompt templates. Applications that pass user-supplied strings as the template argument to Prompt() are vulnerable to Server-Side Template Injection (SSTI), which can lead to Remote Code Execution (RCE) on the host system. This vulnerability is fixed in 2.4.2.

CVSS v3 7.5 HIGH

7.5^/10

CVSS v3 : HIGH

Vector :

Exploitability : 1.6 / Impact : 5.9

Attack Vector NETWORK

Attack Complexity HIGH

Privileges Required NONE

User Interaction REQUIRED

Confidentiality Impact HIGH

Integrity Impact HIGH

Availability Impact HIGH

Scope UNCHANGED

References

Link	Resource
https://github.com/masci/banks/pull/74
https://github.com/masci/banks/security/advisories/GHSA-gphh-9q3h-jgpp
https://access.redhat.com/security/cve/CVE-2026-44209
https://bugzilla.redhat.com/show_bug.cgi?id=2481713
https://github.com/masci/banks/security/advisories/GHSA-gphh-9q3h-jgpp
https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-44209.json

Configurations

No configuration.

History

No history.

Information

Published : 2026-05-26 21:16

Updated : 2026-07-24 13:18

NVD link : CVE-2026-44209

Mitre link : CVE-2026-44209

CVE.ORG link : CVE-2026-44209

JSON object : View

Products Affected

No product.

CWE

CWE-1336

Improper Neutralization of Special Elements Used in a Template Engine

CWE-917

Improper Neutralization of Special Elements used in an Expression Language Statement ('Expression Language Injection')

{"id": "CVE-2026-44209", "cveTags": [], "metrics": {"ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2026-44209", "role": "CISA Coordinator", "options": [{"exploitation": "poc"}, {"automatable": "no"}, {"technicalImpact": "total"}], "version": "2.0.3", "timestamp": "2026-05-28T14:07:18.330651Z"}}], "cvssMetricV31": [{"type": "Secondary", "source": "security-advisories@github.com", "cvssData": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 7.5, "attackVector": "NETWORK", "baseSeverity": "HIGH", "vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H", "integrityImpact": "HIGH", "userInteraction": "REQUIRED", "attackComplexity": "HIGH", "availabilityImpact": "HIGH", "privilegesRequired": "NONE", "confidentialityImpact": "HIGH"}, "impactScore": 5.9, "exploitabilityScore": 1.6}, {"type": "Secondary", "source": "0b0ca135-0b70-47e7-9f44-1890c2a1c46c", "cvssData": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 7.5, "attackVector": "NETWORK", "baseSeverity": "HIGH", "vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H", "integrityImpact": "HIGH", "userInteraction": "REQUIRED", "attackComplexity": "HIGH", "availabilityImpact": "HIGH", "privilegesRequired": "NONE", "confidentialityImpact": "HIGH"}, "impactScore": 5.9, "exploitabilityScore": 1.6}]}, "affected": [{"source": "security-advisories@github.com", "affectedData": [{"vendor": "masci", "product": "banks", "versions": [{"status": "affected", "version": "< 2.4.2"}]}]}, {"source": "0b0ca135-0b70-47e7-9f44-1890c2a1c46c", "affectedData": [{"cpes": ["cpe:/a:redhat:exploit_intelligence:0"], "vendor": "Red Hat", "product": "Exploit Intelligence", "packageName": "exploit-intelligence-tech-preview/vulnerability-analysis-rhel9", "collectionURL": "https://access.redhat.com/downloads/content/package-browser/", "defaultStatus": "affected"}, {"cpes": ["cpe:/a:redhat:openshift_lightspeed"], "vendor": "Red Hat", "product": "OpenShift Lightspeed", "packageName": "openshift-lightspeed/lightspeed-ocp-rag-rhel9", "collectionURL": "https://access.redhat.com/downloads/content/package-browser/", "defaultStatus": "unaffected"}, {"cpes": ["cpe:/a:redhat:openshift_lightspeed"], "vendor": "Red Hat", "product": "OpenShift Lightspeed", "packageName": "openshift-lightspeed/lightspeed-service-api-rhel9", "collectionURL": "https://access.redhat.com/downloads/content/package-browser/", "defaultStatus": "unaffected"}, {"cpes": ["cpe:/a:redhat:openshift_lightspeed"], "vendor": "Red Hat", "product": "OpenShift Lightspeed", "packageName": "openshift-lightspeed-tech-preview/lightspeed-rag-tool-rhel9", "collectionURL": "https://access.redhat.com/downloads/content/package-browser/", "defaultStatus": "unaffected"}, {"cpes": ["cpe:/a:redhat:ansible_automation_platform:2"], "vendor": "Red Hat", "product": "Red Hat Ansible Automation Platform 2", "packageName": "ansible-automation-platform-25/lightspeed-chatbot-rhel8", "collectionURL": "https://access.redhat.com/downloads/content/package-browser/", "defaultStatus": "affected"}]}], "published": "2026-05-26T21:16:37.620", "references": [{"url": "https://github.com/masci/banks/pull/74", "source": "security-advisories@github.com"}, {"url": "https://github.com/masci/banks/security/advisories/GHSA-gphh-9q3h-jgpp", "source": "security-advisories@github.com"}, {"url": "https://access.redhat.com/security/cve/CVE-2026-44209", "source": "0b0ca135-0b70-47e7-9f44-1890c2a1c46c"}, {"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2481713", "source": "0b0ca135-0b70-47e7-9f44-1890c2a1c46c"}, {"url": "https://github.com/masci/banks/security/advisories/GHSA-gphh-9q3h-jgpp", "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0"}, {"url": "https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-44209.json", "source": "0b0ca135-0b70-47e7-9f44-1890c2a1c46c"}], "vulnStatus": "Deferred", "weaknesses": [{"type": "Secondary", "source": "security-advisories@github.com", "description": [{"lang": "en", "value": "CWE-1336"}]}, {"type": "Secondary", "source": "0b0ca135-0b70-47e7-9f44-1890c2a1c46c", "description": [{"lang": "en", "value": "CWE-917"}]}], "descriptions": [{"lang": "en", "value": "Banks generates meaningful LLM prompts using a template language that makes sense. Prior to 2.4.2, banks uses jinja2.Environment() (unsandboxed) to render prompt templates. Applications that pass user-supplied strings as the template argument to Prompt() are vulnerable to Server-Side Template Injection (SSTI), which can lead to Remote Code Execution (RCE) on the host system. This vulnerability is fixed in 2.4.2."}, {"lang": "es", "value": "Banks genera prompts de LLM significativos utilizando un lenguaje de plantillas que tiene sentido. Antes de la versi\u00f3n 2.4.2, Banks utiliza jinja2.Environment() (sin sandbox) para renderizar plantillas de prompts. Las aplicaciones que pasan cadenas proporcionadas por el usuario como argumento de plantilla a Prompt() son vulnerables a la Inyecci\u00f3n de Plantillas del Lado del Servidor (SSTI), lo que puede conducir a la Ejecuci\u00f3n Remota de C\u00f3digo (RCE) en el sistema anfitri\u00f3n. Esta vulnerabilidad est\u00e1 corregida en la versi\u00f3n 2.4.2."}], "lastModified": "2026-07-24T13:18:22.047", "sourceIdentifier": "security-advisories@github.com"}