HIGH 7.5 GitHub
CVE-2026-61536
Banks: Unsafe importlib.import_module of attacker-controlled Tool.import_path in CompletionExtension allows RCE
## Summary
`banks` parses `Tool` JSON objects from the rendered body of `{% completion %}` blocks and later resolves their
`import_path` field through `importlib.import_module(...)` + `getattr(...)` to obtain the callable that handles a tool
call. There is no allowlist or sanitization on `import_path`, so any importable Python attribute (e.g. `os.system`,
`subprocess.getoutput`) can be selected. When the LLM emits a `tool_calls` entry whose `function.name` matches the
attacker-suppli
Affected Products
- pip/banks <= 2.4.2
References
- https://github.com/advisories/GHSA-64vx-6h2c-rjh7
- https://github.com/masci/banks/security/advisories/GHSA-64vx-6h2c-rjh7
- https://nvd.nist.gov/vuln/detail/CVE-2026-61536
- https://github.com/masci/banks/pull/75
This high severity vulnerability with a CVSS score of 7.5 was published on 2026-11-05 via GitHub. Affected: pip/banks <= 2.4.2.
vulnfeed aggregates 16740 vulnerabilities from NVD, CISA KEV,
Ubuntu, Debian, Red Hat, Kubernetes, Exploit-DB, OSS-Security, GitHub and OpenStack — updated every 4 hours.