HIGH 7.3 NVD
CVE-2026-107716
Banks generates meaningful LLM prompts using a simple template language. Prior to 2.5.1, Banks DirectoryPromptRegistry does not reject symbolic links for index.
Banks generates meaningful LLM prompts using a simple template language. Prior to 2.5.1, Banks DirectoryPromptRegistry does not reject symbolic links for index.json or discovered and existing .jinja prompt files. In an application where untrusted users can influence a prompt directory, DirectoryPromptRegistry._scan() and DirectoryPromptRegistry.get() can follow a link outside the registry root and disclose a file, while DirectoryPromptRegistry.set(), DirectoryPromptRegistry._save(), and DirectoryPromptRegistry._load() can read or overwrite an external link target. The issue requires attacker influence over the registry directory or its extracted contents. This issue is fixed in version 2.5.1.
References
- https://github.com/masci/banks/commit/23ed13e50b4e217693fa5f9c30943fac8a41582f
- https://github.com/masci/banks/pull/79
- https://github.com/masci/banks/releases/tag/v2.5.1
- https://github.com/masci/banks/security/advisories/GHSA-556j-vv39-8rqv
This high severity vulnerability with a CVSS score of 7.3 was published on 2026-10-08 via NVD.
vulnfeed aggregates 13827 vulnerabilities from NVD, CISA KEV,
Ubuntu, Debian, Red Hat, Kubernetes, Exploit-DB, OSS-Security, GitHub and OpenStack — updated every 4 hours.