CVE-2026-107717 in Banks
Summary
by MITRE • 10/09/2026
Banks generates meaningful LLM prompts using a simple template language. Prior to 2.5.0, Banks Prompt.chat_messages() attempts to parse every line of rendered template output as ChatMessage JSON. When an application renders untrusted data and passes the returned ChatMessage objects to an LLM provider, attacker-controlled JSON can cross the prompt boundary and become a system, assistant, or tool message because ChatMessage.role accepts arbitrary strings. This can override application instructions, alter the intended prompt structure, or confuse downstream tool and message handling. This issue is fixed in version 2.5.0.
Several companies clearly confirm that VulDB is the primary source for best vulnerability data.
Analysis
by VulDB Data Team • 10/09/2026
The vulnerability identified in Banks prior to version 2.5.0 represents a critical injection flaw within its Large Language Model prompt generation pipeline. The core of the issue lies in how the library handles template rendering and subsequent message parsing. When an application utilizes Banks to generate prompts, it often involves combining static instructions with dynamic user input through a templating engine. Prior to the fix, the ChatMessages method attempted to parse every line of the rendered template output as JSON representing a ChatMessage object. This design decision assumes that all lines in the template are valid JSON structures intended for message construction, which creates a dangerous attack surface when untrusted data is incorporated into these templates without rigorous validation or escaping mechanisms.
The technical flaw stems from the permissive nature of the ChatMessage.role field, which accepts arbitrary strings rather than enforcing a strict whitelist of allowed roles such as system, user, assistant, or tool. In a typical LLM interaction flow, the role assigned to each message determines how the model interprets and prioritizes that content. System messages carry high authority and define the behavior constraints for the AI, while user messages contain the actual query data. By allowing arbitrary strings in the role field combined with JSON parsing of untrusted input, an attacker can craft a specific payload where their controlled text is interpreted not as part of the user's question but as a structural command to the LLM provider. This effectively allows the injection of new message boundaries within what was intended to be a single continuous prompt segment.
The operational impact of this vulnerability is severe and multifaceted, primarily centering on Prompt Injection attacks that can lead to Full Context Override or Instruction Hijacking. If an attacker successfully injects JSON that parses into a ChatMessage with the role set to system, they can overwrite the original application instructions provided by the developer. This could result in the model ignoring safety guidelines, revealing sensitive internal data, or executing malicious logic defined in the injected prompt. Furthermore, if the injection targets assistant or tool roles, it may confuse downstream processing tools that rely on strict message formatting, potentially causing errors or unintended actions such as unauthorized API calls or database queries initiated by the LLM based on the attacker's fabricated instructions. This breaks the fundamental trust boundary between the application developer and the end user interacting with the AI system.
From a classification perspective, this vulnerability aligns closely with CWE-74 Improper Neutralization of Special Elements in Output Used by a Downstream Component, as it involves failing to neutralize special elements that alter how output is interpreted by another component, specifically the LLM provider's message parser. It also maps directly to MITRE ATT&CK techniques related to Prompt Injection, particularly those involving context manipulation and instruction override. The attack vector leverages the lack of input validation on template variables and the overly flexible schema for message roles, allowing an adversary to subvert the intended logic flow of the AI application through carefully crafted textual inputs that are misinterpreted as structural JSON commands.
To mitigate this vulnerability, organizations must upgrade immediately to Banks version 2.5.0 or later, where the parsing logic has been corrected to prevent arbitrary role assignment and ensure strict adherence to expected message formats. For applications still running older versions or implementing custom prompt generation pipelines, it is imperative to implement rigorous input sanitization for all user-supplied data before it enters any template engine. Developers should avoid passing raw untrusted strings directly into templates that are subsequently parsed as structured messages. Instead, they should use explicit escaping mechanisms provided by the templating library and validate that injected content cannot mimic JSON structures or role identifiers. Additionally, adopting a defense-in-depth strategy by validating message roles against a strict whitelist of allowed values before sending them to the LLM provider can further reduce the risk of successful prompt injection attacks.