Banks generates meaningful LLM prompts using a simple template language. In versions prior to 2.4.3, banks parses Tool JSON objects from the rendered body of {%…

CVE-2026-61536 affects the 'banks' Python library (versions prior to 2.4.3), which generates LLM prompts using a template language. The vulnerability exists in src/banks/extensions/completion.py, where Tool JSON objects parsed from rendered completion blocks have their import_path field resolved via importlib.import_module() and getattr() without any allowlist or sanitization. An attacker can supply a malicious Tool JSON causing the LLM to emit a tool_calls entry that invokes arbitrary Python callables such as os.system or subprocess.getoutput, resulting in arbitrary code execution in the hosting process. This is distinct from the previously patched CVE-2026-44209 (GHSA-gphh-9q3h-jgpp), which was fixed in version 2.4.2 by switching to SandboxedEnvironment — a fix that does not address this vector since the malicious payload is plain text and requires no Jinja attribute access. The issue has been fully remediated in version 2.4.3.