CVE-2026-61536

creationtimestamp| type| source ---|---|--- 2026-07-30 19:54:16+00:00| seen| https://bsky.app/profile/cve.skyfleet.blue/post/ijlhn7uk5lbef 2026-07-30 20:00:50+00:00| seen| https://bsky.app/profile/thehackerwire.bsky.social/post/3mrva5o4eg52q...

voice-agent-tequity (>=0.1.0, <=0.1.1) potentially affected by CVE-2026-61536 via banks (2.2.0)

banks PYPI version 2.2.0 is affected by a known vulnerability. The following packages have a transitive dependency on banks and may be impacted: - voice-agent-tequity =0.1.0, =0.1.1 Source cves: CVE-2026-61536 Source advisory: MEND:CVE-2026-61536...

CVE-2026-61536 Banks: Unsafe importlib.import_module of attacker-controlled Tool.import_path in CompletionExtension allows RCE

Banks generates meaningful LLM prompts using a simple template language. In versions prior to 2.4.3, banks parses Tool JSON objects from the rendered body of % completion % blocks and later resolves their importpath field through importlib.importmodule... + getattr... to obtain the callable that...