CVE-2026-61536

{"id": "CVE-2026-61536", "cveTags": [], "metrics": {"ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2026-61536", "role": "CISA Coordinator", "options": [{"exploitation": "poc"}, {"automatable": "no"}, {"technicalImpact": "total"}], "version": "2.0.3", "timestamp": "2026-07-31T23:00:33.742984Z"}}], "cvssMetricV31": [{"type": "Secondary", "source": "security-advisories@github.com", "cvssData": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 7.5, "attackVector": "NETWORK", "baseSeverity": "HIGH", "vectorString": "CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H", "integrityImpact": "HIGH", "userInteraction": "NONE", "attackComplexity": "HIGH", "availabilityImpact": "HIGH", "privilegesRequired": "LOW", "confidentialityImpact": "HIGH"}, "impactScore": 5.9, "exploitabilityScore": 1.6}]}, "affected": [{"source": "security-advisories@github.com", "affectedData": [{"vendor": "masci", "product": "banks", "versions": [{"status": "affected", "version": "< 2.4.3"}]}]}], "published": "2026-07-30T19:18:34.553", "references": [{"url": "https://github.com/masci/banks/security/advisories/GHSA-64vx-6h2c-rjh7", "source": "security-advisories@github.com"}, {"url": "https://github.com/masci/banks/security/advisories/GHSA-64vx-6h2c-rjh7", "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0"}], "vulnStatus": "Deferred", "weaknesses": [{"type": "Secondary", "source": "security-advisories@github.com", "description": [{"lang": "en", "value": "CWE-94"}, {"lang": "en", "value": "CWE-470"}]}], "descriptions": [{"lang": "en", "value": "Banks generates meaningful LLM prompts using a simple template language. In versions prior to 2.4.3, banks parses Tool JSON objects from the rendered body of {% completion %} blocks and later resolves their import_path field through importlib.import_module(...) + getattr(...) to obtain the callable that handles a tool call. There is no allowlist or sanitization on import_path, so any importable Python attribute (e.g. os.system, subprocess.getoutput) can be selected. When the LLM emits a tool_calls entry whose function.name matches the attacker-supplied tool name, the resolved callable is invoked with kwargs decoded from tool_call.function.arguments, yielding arbitrary code execution in the banks-hosting process. This is distinct from GHSA-gphh-9q3h-jgpp / CVE-2026-44209. That advisory was fixed in 2.4.2 by switching src/banks/env.py from Environment to SandboxedEnvironment. The fix does not touch src/banks/extensions/completion.py, and the unsafe import + getattr chain still executes on 2.4.2. The malicious Tool JSON is plain text in the rendered template body \u2014 it requires no Jinja attribute access, so the sandbox is irrelevant. This issue has been fixed in version 2.4.3."}, {"lang": "es", "value": "Banks genera prompts de LLM significativos utilizando un lenguaje de plantillas simple. En versiones anteriores a la 2.4.3, banks analiza objetos JSON de Tool del cuerpo renderizado de los bloques {% completion %} y posteriormente resuelve su campo import_path a trav\u00e9s de importlib.import_module(...) + getattr(...) para obtener el invocable que maneja una llamada a herramienta. No hay una lista de permitidos (allowlist) ni sanitizaci\u00f3n en import_path, por lo que cualquier atributo Python importable (por ejemplo, os.system, subprocess.getoutput) puede ser seleccionado. Cuando el LLM emite una entrada tool_calls cuyo function.name coincide con el nombre de la herramienta proporcionado por el atacante, el invocable resuelto es invocado con kwargs decodificados de tool_call.function.arguments, produciendo ejecuci\u00f3n de c\u00f3digo arbitrario en el proceso que aloja banks. Esto es distinto de GHSA-gphh-9q3h-jgpp / CVE-2026-44209. Esa advertencia se corrigi\u00f3 en la 2.4.2 cambiando src/banks/env.py de Environment a SandboxedEnvironment. La correcci\u00f3n no afecta a src/banks/extensions/completion.py, y la cadena insegura de import + getattr todav\u00eda se ejecuta en la 2.4.2. El JSON de Tool malicioso es texto plano en el cuerpo de la plantilla renderizada - no requiere acceso a atributos de Jinja, por lo que el sandbox es irrelevante. Este problema ha sido corregido en la versi\u00f3n 2.4.3."}], "lastModified": "2026-10-23T22:10:00.160", "sourceIdentifier": "security-advisories@github.com"}