CVE-2026-61536

creationtimestamp| type| source ---|---|--- 2026-07-30 19:54:16+00:00| seen| https://bsky.app/profile/cve.skyfleet.blue/post/ijlhn7uk5lbef 2026-07-30 20:00:50+00:00| seen| https://bsky.app/profile/thehackerwire.bsky.social/post/3mrva5o4eg52q...

CVE-2026-61536 Banks: Unsafe importlib.import_module of attacker-controlled Tool.import_path in CompletionExtension allows RCE

Banks generates meaningful LLM prompts using a simple template language. In versions prior to 2.4.3, banks parses Tool JSON objects from the rendered body of % completion % blocks and later resolves their importpath field through importlib.importmodule... + getattr... to obtain the callable that...