CVE-2026-107717

The Banks library (prior to version 2.5.0 ) is vulnerable to a prompt injection flaw in the Prompt.chat_messages() function. The issue stems from the software attempting to parse every line of rendered template output as ChatMessage JSON . Because ChatMessage.role accepts arbitrary strings, an at...