Malicious tool definitions let attackers run arbitrary code in banks despite Jinja sandbox fix

A malicious prompt can make the banks LLM template library run arbitrary code through its tool-handling path, GitHub's advisory warns. The flaw survives the 2.4.2 Jinja sandbox patch because it resolves import_path in Python rather than through templates.

Affected

banks (pip) <= 2.4.2

Fixed

banks (pip) 2.4.3

The library parses Tool objects—including attacker-controlled import_path strings—from the rendered body of {% completion %} blocks. It then calls importlib.import_module and getattr on that dotted path with no allowlist, so a name such as os.system resolves to any importable callable and runs with the process's privileges.

Versions at or below 2.4.2 are affected; 2.4.3 contains the fix. The earlier CVE-2026-44209 patch only sandboxed Jinja rendering and left this Python-level import chain untouched, so the sandbox does not block it.

Update banks to 2.4.3, or restrict tool resolution to callables registered by the application at startup rather than arbitrary import paths.