CVE-2026-107717: Banks Package Vulnerability - User-Controlled Prompt Input Parsed as Privileged Chat Messages
Summary
CVE-2026-107717: Banks: User-controlled prompt input can be parsed as privileged chat messages. Affects banks versions < 2.5.0. Fixed in 2.5.0. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Habilume
Habit tracker with a companion that grows with you
Complete habits, earn Lume Points, and watch your Lume grow as you stay consistent.
Background
The Banks package is a Python library designed for managing chat prompts and messages in applications that utilize language models. It allows developers to create dynamic chat interfaces by rendering templates that can include user input. However, the package has a vulnerability that arises from the way it handles user-controlled input, particularly in the Prompt.chat_messages() method, which can lead to unintended parsing of user input as privileged messages.
Vulnerability Detail
The vulnerability exists in the Prompt.chat_messages() method of the Banks package, where it parses every rendered output line as a potential ChatMessage JSON object. If an attacker can control the template data, they can craft input that is rendered as a JSON object, such as {"role":"system","content":"..."}. This allows the attacker to inject privileged messages, such as system or assistant messages, which can alter the intended prompt structure and bypass application-defined boundaries. The impact of this vulnerability can lead to serious security issues, including the ability to override instructions or confuse downstream message handling.
How To Fix
Latest published version: 2.5.1 as of 23 Oct 2026
pip install --upgrade "banks==2.5.1"Upgrading to it may include breaking changes; the version below is the minimum fixed release for this vulnerability.
If you need the minimum change
2.5.0
This is the first release that contains the fix.
pip install --upgrade "banks==2.5.0"Tip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
As a temporary workaround, avoid rendering untrusted user input directly in the prompt templates. Instead, sanitize or validate user input before passing it to the Prompt.chat_messages() method. For example, you can implement a function to escape or filter out potentially harmful input before rendering it.
Conclusion
The CVE-2026-107717 vulnerability in the Banks package poses a significant risk by allowing user-controlled input to be parsed as privileged messages. It is crucial for developers using this package to update to the patched version and implement proper input validation to mitigate potential security risks.
See every vulnerability recorded for banks →
FAQ
CVE-2026-107717 is a vulnerability in the Banks package that allows user-controlled input to be parsed as privileged chat messages, potentially leading to chat role injection.
If your application uses the Banks package and renders untrusted user input with the Prompt.chat_messages() method, it may be affected by this vulnerability. You can check your application's dependencies using tools like Vulert.
The vulnerability can allow attackers to inject system or assistant messages, altering the intended prompt structure and potentially leading to security breaches or unintended behavior in applications.
Yes, the vulnerability has been patched in version 2.5.0 of the Banks package. It is recommended to update to this version or later.
You can use Vulert, which monitors and alerts in real-time for open-source vulnerabilities in your software. You can check if your application is affected by this vulnerability using the Vulert playground without any signup.
References
Related vulnerabilities
Recent vulnerabilities recorded for banks.
Habilume
Habit tracker with a companion that grows with you
Complete habits, earn Lume Points, and watch your Lume grow as you stay consistent.
