CVE-2026-44209

Banks: Critical Remote Code Execution (RCE) via Jinja2 SSTI

Published May 26, 2026 CVSS 3.1 · 7.5 High EPSS < 1% KEV · Not listed

Description

Banks generates meaningful LLM prompts using a template language that makes sense. Prior to 2.4.2, banks uses jinja2.Environment() (unsandboxed) to render prompt templates. Applications that pass user-supplied strings as the template argument to Prompt() are vulnerable to Server-Side Template Injection (SSTI), which can lead to Remote Code Execution (RCE) on the host system. This vulnerability is fixed in 2.4.2.

Analysis

Technical impact

Banks renders LLM prompt templates using Jinja2’s Environment without sandboxing. When an application passes a user‑supplied string directly to the Prompt() function, the unsanitised template can execute arbitrary Python code. This leads to remote code execution on the host and is classified as a server‑side template injection flaw (CWE-1336) and a code execution vulnerability (CWE-917).

Affected Systems

The affected product is Banks from the masci organization. Versions earlier than 2.4.2 use the vulnerable rendering engine and are therefore impacted. The issue is fixed in 2.4.2, with no additional patch information provided.

Risk and Exploitability

The CVSS score is 7.5, indicating high severity, and the EPSS score of 0.00539, which translates to a very low current exploitation probability. The vulnerability is not listed in CISA KEV. Because the attack requires supplying a malicious template string to Prompt(), it can be executed remotely from any interface that allows user‑provided prompt content. Successful exploitation results in full code execution on the server hosting Banks.

Affected Products

Default status is the baseline for the product, each version can override it (e.g. patched versions marked unaffected).

Vendor Product Default status Versions

masci

banks

affected

Version	Status	Constraints
`< 2.4.2`	affected	—

No data.

Vendor Product Versions

Masci

Banks

Version	Status	Scheme	Platform
`[0,2.4.2)`	affected	semver	—

Remediation

No solution or workaround provided in the CVE record.

OpenCVE Recommended Actions

Upgrade Banks to version 2.4.2 or later, which removes the unsandboxed Jinja2 rendering.
If an upgrade cannot be performed immediately, hard‑enforce that the Prompt() function receives only pre‑validated or constant templates and rejects any dynamic user‑supplied strings.
Consider reimplementing the prompt rendering with a sandboxed Jinja2 environment or an alternative safe templating library to mitigate future injection risks.

Generated by OpenCVE AI on August 13, 2026 at 23:34 UTC.

Tracking

Advisories

Source	ID	Title
Github GHSA	GHSA-gphh-9q3h-jgpp	banks has Critical Remote Code Execution (RCE) via Jinja2 SSTI

Metrics

No CVSS v4.0

Attack Vector Network

Attack Complexity High

Privileges Required None

Scope Unchanged

Confidentiality Impact High

Integrity Impact High

Availability Impact High

User Interaction Required

No CVSS v3.0

No CVSS v2

This CVE is not in the KEV list.

Exploit prediction score: < 1% (0.423% probability within 30 days)

Exploitation poc

Automatable no

Technical Impact total

References

Link	Providers
https://access.redhat.com/security/cve/CVE-2026-44209
https://bugzilla.redhat.com/show_bug.cgi?id=2481713
https://github.com/masci/banks/pull/74
https://github.com/masci/banks/security/advisories/GHSA-gphh-9q3h-jgpp
https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-44209.json

History

Jun 30, 2026 5:30 AM Scoring metrics updated View changes

Type	Values Removed	Values Added
Metrics		ssvc `{'options': {'Automatable': 'no', 'Exploitation': 'poc', 'Technical Impact': 'total'}, 'version': '2.0.3'}`

May 27, 2026 10:30 AM First appearance in the feed. Affected vendors updated View changes

Type	Values Removed	Values Added
First Time appeared		Masci Masci banks
Vendors & Products		Masci Masci banks

May 26, 2026 9:15 PM Description updated. Title updated. Weaknesses updated. Added references. Scoring metrics updated View changes

Type	Values Removed	Values Added
Description		Banks generates meaningful LLM prompts using a template language that makes sense. Prior to 2.4.2, banks uses jinja2.Environment() (unsandboxed) to render prompt templates. Applications that pass user-supplied strings as the template argument to Prompt() are vulnerable to Server-Side Template Injection (SSTI), which can lead to Remote Code Execution (RCE) on the host system. This vulnerability is fixed in 2.4.2.
Title		Banks: Critical Remote Code Execution (RCE) via Jinja2 SSTI
Weaknesses		CWE-1336
References		https://github.com/masci/banks/pull/74 https://github.com/masci/banks/security/advisories/GHSA-gphh-9q3h-jgpp
Metrics		cvssV3_1 `{'score': 7.5, 'vector': 'CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H'}`

Subscriptions

Masci Banks

Weaknesses

CWE-1336
Improper Neutralization of Special Elements Used in a Template Engine
CWE-917
Improper Neutralization of Special Elements used in an Expression Language Statement ('Expression Language Injection')