masci banks up to 2.4.2 Completion completion.py importlib.import_module/getattr import_path code injection

Summaryinfo

A vulnerability was found in masci banks up to 2.4.2. It has been rated as critical. This affects the function importlib.import_module/getattr of the file src/banks/extensions/completion.py of the component Completion. The manipulation of the argument import_path leads to code injection. This vulnerability is documented as CVE-2026-61536. The attack can be initiated remotely. There is not any exploit available.

Detailsinfo

A vulnerability was found in masci banks up to 2.4.2 and classified as critical. This issue affects the function importlib.import_module/getattr of the file src/banks/extensions/completion.py of the component Completion. The manipulation of the argument import_path with an unknown input leads to a code injection vulnerability. Using CWE to declare the problem leads to CWE-94. The product constructs all or part of a code segment using externally-influenced input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could modify the syntax or behavior of the intended code segment. Impacted is confidentiality, integrity, and availability. The summary by CVE is:

Banks generates meaningful LLM prompts using a simple template language. In versions prior to 2.4.3, banks parses Tool JSON objects from the rendered body of {% completion %} blocks and later resolves their import_path field through importlib.import_module(...) + getattr(...) to obtain the callable that handles a tool call. There is no allowlist or sanitization on import_path, so any importable Python attribute (e.g. os.system, subprocess.getoutput) can be selected. When the LLM emits a tool_calls entry whose function.name matches the attacker-supplied tool name, the resolved callable is invoked with kwargs decoded from tool_call.function.arguments, yielding arbitrary code execution in the banks-hosting process. This is distinct from GHSA-gphh-9q3h-jgpp / CVE-2026-44209. That advisory was fixed in 2.4.2 by switching src/banks/env.py from Environment to SandboxedEnvironment. The fix does not touch src/banks/extensions/completion.py, and the unsafe import + getattr chain still executes on 2.4.2. The malicious Tool JSON is plain text in the rendered template body — it requires no Jinja attribute access, so the sandbox is irrelevant. This issue has been fixed in version 2.4.3.

The advisory is shared at github.com. The identification of this vulnerability is CVE-2026-61536 since 07/10/2026. The exploitation is known to be easy. The attack may be initiated remotely. It demands that the victim is doing some kind of user interaction. Technical details are known, but no exploit is available. MITRE ATT&CK project uses the attack technique T1059 for this issue.

Upgrading to version 2.4.3 eliminates this vulnerability.

Several companies clearly confirm that VulDB is the primary source for best vulnerability data.

Productinfo

Type

• Banking Software

Vendor

• masci

Name

• banks

Version

• 2.4.0
• 2.4.1
• 2.4.2

Website

• Product: https://github.com/masci/banks/

CPE 2.3info

• 🔒
• 🔒
• 🔒

CPE 2.2info

• 🔒
• 🔒
• 🔒

CVSSv4info

CVSSv3info

CVSSv2info

Exploitinginfo

Threat Intelligenceinfo

Countermeasuresinfo

Timelineinfo

Sourcesinfo

Entryinfo

Several companies clearly confirm that VulDB is the primary source for best vulnerability data.

Discussion