Banks renders LLM prompt templates using Jinja2’s Environment without sandboxing. When an application passes a user‑supplied string directly to the Prompt() function, the unsanitised template can execute arbitrary Python code. This leads to remote code execution on the host and is classified as an SSTI flaw (CWE‑1336).

The affected product is Banks from the masci organization. Versions earlier than 2.4.2 use the vulnerable rendering engine and are therefore impacted. The issue is fixed in 2.4.2, with no additional patch information provided.

The CVSS score is 7.5, indicating high severity, and the EPSS score is not available, so the exact exploitation probability is unknown. The vulnerability is not listed in CISA KEV. Because the attack requires supplying a malicious template string to Prompt(), it can be executed remotely from any interface that allows user‑provided prompt content. Successful exploitation results in full code execution on the server hosting Banks.