Banks allows an attacker to manipulate the import_path field of a tool specification inside a completion block to import and execute any importable Python attribute, such as os.system or subprocess.getoutput. The system performs importlib.import_module followed by getattr without any allowlist, causing arbitrary code to run in the banks-hosting process. The CVSS score of 7.5 reflects the ability to achieve complete process compromise whenever a malicious LLM prompt triggers the vulnerable tool call. This weakness is a classic instance of CWE‑470 (Use of Hard-Coded Resource or Logic) and CWE‑94 (Improper Handling of Code Injection).

The affected product is masci:banks. Any instance running a version prior to 2.4.3 is vulnerable. The bug was resolved in banks 2.4.3 and later releases; versions 2.4.2 and earlier remain at risk. No other affected vendors or product lines are listed.

The vulnerability has a high severity but the EPSS score is <1%; KEV lists it as not exploited yet. Attackers can exploit it primarily by submitting a crafted prompt that includes a malicious tool call; no additional access or privilege is required beyond permission to invoke the LLM. Once triggered, the bug gives full control over the host process. Continued exploitation risk is significant for systems that accept untrusted prompts or lack a sandboxed execution environment. The lack of an allowlist or sanitization makes the RCE straightforward when the LLM emits a matching tool call.