CVE-2026-71492 Banks: Path traversal in `DirectoryPromptRegistry.set()` allows arbitrary file write outside the registry root

Banks generates meaningful LLM prompts using a simple template language. Prior to version 2.4.5, DirectoryPromptRegistry.set in src/banks/registries/directory.py interpolates attacker-controlled Prompt.name and Prompt.version values into a Path without canonicalization or containment validation...

PT-2026-79053

Name of the Vulnerable Software and Affected Versions Banks versions prior to 2.4.5 Description The DirectoryPromptRegistry.set function in src/banks/registries/directory.py fails to perform canonicalization or containment validation when interpolating Prompt.name and Prompt.version values into a...