6 matches found
Banks: User-controlled prompt input can be parsed as privileged chat messages
Summary Banks' Prompt.chatmessages method parses every rendered output line as a potential ChatMessage JSON object. If attacker-controlled template data renders to JSON such as "role":"system","content":"...", Banks returns it as a privileged system message instead of treating it as plain...
PYSEC-2026-4202 Banks: User-controlled prompt input can be parsed as privileged chat messages
Summary Banks' Prompt.chatmessages method parses every rendered output line as a potential ChatMessage JSON object. If attacker-controlled template data renders to JSON such as "role":"system","content":"...", Banks returns it as a privileged system message instead of treating it as plain...
Banks: User-controlled prompt input can be parsed as privileged chat messages
Summary Banks' Prompt.chatmessages method parses every rendered output line as a potential ChatMessage JSON object. If attacker-controlled template data renders to JSON such as "role":"system","content":"...", Banks returns it as a privileged system message instead of treating it as plain...
GHSA-HMQ2-7HP6-7CRH Banks: User-controlled prompt input can be parsed as privileged chat messages
Summary Banks' Prompt.chatmessages method parses every rendered output line as a potential ChatMessage JSON object. If attacker-controlled template data renders to JSON such as "role":"system","content":"...", Banks returns it as a privileged system message instead of treating it as plain...
PT-2026-108246
Name of the Vulnerable Software and Affected Versions Banks versions prior to 2.5.0 Description The Prompt.chat messages function attempts to parse every line of rendered template output as ChatMessage JSON. When an application renders untrusted data, attacker-controlled JSON can be interpreted a...
PT-2026-108660
Summary Banks' Prompt.chat messages method parses every rendered output line as a potential ChatMessage JSON object. If attacker-controlled template data renders to JSON such as "role":"system","content":"...", Banks returns it as a privileged system message instead of treating it as plain...