Medium

Banks: User-controlled prompt input can be parsed as privileged chat messages

Type: advisorySources: OSV

Banks generates meaningful LLM prompts using a simple template language. Prior to 2.5.0, Banks Prompt.chat_messages() attempts to parse every line of rendered template output as ChatMessage JSON. When an application renders untrusted data and passes the returned ChatMessage objects to an LLM provider, attacker-controlled JSON can cross the prompt boundary and become a system, assistant, or tool message because ChatMessage.role accepts arbitrary strings. This can override application instructions, alter the intended prompt structure, or confuse downstream tool and message handling. This issue is fixed in version 2.5.0.

Products: Not specified
Affected versions: Not specified
Fixed versions: Not specified
CVEs: CVE-2026-107717
Confirmed fixed CVEs: Not specified
Updated in this feed: 4 Nov 2026, 03:19 UTC · Revision 1

Source evidence

Banks: User-controlled prompt input can be parsed as privileged chat messages

core-osv · Original source

Published 8 Oct 2026, 21:38 UTC

osv:CVE-2026-107717

Complete source record

{
  "id": "0b312066280e9a9f75aa690445c71e78aa005921d261275490c112568218cc9d",
  "url": "https://osv.dev/vulnerability/CVE-2026-107717",
  "method": "structured",
  "payload": {
    "kind": "advisory",
    "title": "Banks: User-controlled prompt input can be parsed as privileged chat messages",
    "summary": "Banks generates meaningful LLM prompts using a simple template language. Prior to 2.5.0, Banks Prompt.chat_messages() attempts to parse every line of rendered template output as ChatMessage JSON. When an application renders untrusted data and passes the returned ChatMessage objects to an LLM provider, attacker-controlled JSON can cross the prompt boundary and become a system, assistant, or tool message because ChatMessage.role accepts arbitrary strings. This can override application instructions, alter the intended prompt structure, or confuse downstream tool and message handling. This issue is fixed in version 2.5.0.",
    "evidence": "osv:CVE-2026-107717",
    "products": [],
    "severity": "medium",
    "structured": {
      "id": "CVE-2026-107717",
      "aliases": [
        "CVE-2026-107717",
        "GHSA-hmq2-7hp6-7crh",
        "PYSEC-2026-4202"
      ],
      "metrics": [
        {
          "type": "CVSS_V3",
          "score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N"
        }
      ],
      "affected": [
        {
          "ranges": [
            {
              "repo": "https://github.com/masci/banks",
              "type": "GIT",
              "events": [
                {
                  "introduced": "0"
                },
                {
                  "fixed": "b1feadd9bb635e22ea0a68015f357af8b30df3b6"
                },
                {
                  "fixed": "02172b816fb84f6a824cc09a8aca7416f53c12cb"
                }
              ],
              "database_specific": {
                "extracted_events": [
                  {
                    "range": [
                      {
                        "introduced": "0"
                      },
                      {
                        "fixed": "2.5.0"
                      }
                    ],
                    "source": "AFFECTED_FIELD",
                    "strategy": "StringRangeExpression"
                  },
                  {
                    "range": [
                      {
                        "fixed": "02172b816fb84f6a824cc09a8aca7416f53c12cb"
                      }
                    ],
                    "source": "REFERENCES_COMMIT"
                  },
                  {
                    "range": [
                      {
                        "fixed": "b1feadd9bb635e22ea0a68015f357af8b30df3b6"
                      }
                    ],
                    "source": "REFERENCES_TAG",
                    "original_tag": "v2.5.0"
                  }
                ]
              }
            }
          ],
          "versions": [
            "v2.4.5",
            "v2.4.4",
            "v2.4.3",
            "v2.4.2",
            "v2.4.1",
            "v2.4.0",
            "v2.3.0",
            "v2.2.0",
            "v2.1.3",
            "v2.1.2",
            "v2.1.1",
            "v2.1.0",
            "v2.0.0",
            "v1.8.0",
            "v1.7.1",
            "v1.7.0",
            "v1.6.1",
            "v1.6.0",
            "v1.5.0",
            "v1.4.0",
            "v1.3.0",
            "v1.2.1",
            "v1.2.0",
            "v1.1.0",
            "v1.0.0",
            "v0.6.0",
            "v0.5.0",
            "v0.4.1",
            "v0.4.0",
            "v0.3.1",
            "v0.3.0",
            "v0.2.0",
            "v0.1.1",
            "v0.1.0"
          ],
          "database_specific": {
            "source": "https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-107717.json"
          }
        }
      ],
      "modified": "2026-10-28T02:30:32.901904824Z",
      "provider": "osv",
      "references": [
        "https://github.com/masci/banks/releases/tag/v2.5.0",
        "https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/107xxx/CVE-2026-107717.json",
        "https://github.com/masci/banks/security/advisories/GHSA-hmq2-7hp6-7crh",
        "https://nvd.nist.gov/vuln/detail/CVE-2026-107717",
        "https://github.com/masci/banks/commit/02172b816fb84f6a824cc09a8aca7416f53c12cb",
        "https://github.com/masci/banks/pull/78"
      ],
      "provider_metadata": {
        "cwe_ids": [
          "CWE-20"
        ],
        "cna_assigner": "GitHub_M",
        "osv_generated_from": "https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/107xxx/CVE-2026-107717.json"
      }
    },
    "related_cves": [
      {
        "value": "CVE-2026-107717",
        "evidence": "/id"
      }
    ],
    "security_relevant": true,
    "severity_evidence": "/severity/0/score"
  },
  "source_id": "core-osv",
  "document_id": 499980,
  "published_at": "2026-10-08T21:38:07.447+00:00"
}