CVE-2026-107717

{"dataType": "CVE_RECORD", "dataVersion": "5.2", "cveMetadata": {"cveId": "CVE-2026-107717", "assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa", "state": "PUBLISHED", "assignerShortName": "GitHub_M", "dateReserved": "2026-10-08T17:21:52.975Z", "datePublished": "2026-10-08T21:38:07.447Z", "dateUpdated": "2026-10-13T16:16:13.460Z"}, "containers": {"cna": {"title": "Banks: User-controlled prompt input can be parsed as privileged chat messages", "problemTypes": [{"descriptions": [{"cweId": "CWE-20", "lang": "en", "description": "CWE-20: Improper Input Validation", "type": "CWE"}]}], "metrics": [{"cvssV3_1": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "NONE", "baseScore": 6.5, "baseSeverity": "MEDIUM", "confidentialityImpact": "LOW", "integrityImpact": "LOW", "privilegesRequired": "NONE", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N", "version": "3.1"}}], "references": [{"name": "https://github.com/masci/banks/security/advisories/GHSA-hmq2-7hp6-7crh", "tags": ["x_refsource_CONFIRM"], "url": "https://github.com/masci/banks/security/advisories/GHSA-hmq2-7hp6-7crh"}, {"name": "https://github.com/masci/banks/pull/78", "tags": ["x_refsource_MISC"], "url": "https://github.com/masci/banks/pull/78"}, {"name": "https://github.com/masci/banks/commit/02172b816fb84f6a824cc09a8aca7416f53c12cb", "tags": ["x_refsource_MISC"], "url": "https://github.com/masci/banks/commit/02172b816fb84f6a824cc09a8aca7416f53c12cb"}, {"name": "https://github.com/masci/banks/releases/tag/v2.5.0", "tags": ["x_refsource_MISC"], "url": "https://github.com/masci/banks/releases/tag/v2.5.0"}], "affected": [{"vendor": "masci", "product": "banks", "versions": [{"version": "< 2.5.0", "status": "affected"}]}], "providerMetadata": {"orgId": "a0819718-46f1-4df5-94e2-005712e83aaa", "shortName": "GitHub_M", "dateUpdated": "2026-10-08T21:38:07.447Z"}, "descriptions": [{"lang": "en", "value": "Banks generates meaningful LLM prompts using a simple template language. Prior to 2.5.0, Banks Prompt.chat_messages() attempts to parse every line of rendered template output as ChatMessage JSON. When an application renders untrusted data and passes the returned ChatMessage objects to an LLM provider, attacker-controlled JSON can cross the prompt boundary and become a system, assistant, or tool message because ChatMessage.role accepts arbitrary strings. This can override application instructions, alter the intended prompt structure, or confuse downstream tool and message handling. This issue is fixed in version 2.5.0."}], "source": {"advisory": "GHSA-hmq2-7hp6-7crh", "discovery": "UNKNOWN"}}, "adp": [{"references": [{"url": "https://github.com/masci/banks/security/advisories/GHSA-hmq2-7hp6-7crh", "tags": ["exploit"]}], "metrics": [{"other": {"type": "ssvc", "content": {"timestamp": "2026-10-13T16:15:40.228940Z", "id": "CVE-2026-107717", "options": [{"Exploitation": "poc"}, {"Automatable": "yes"}, {"Technical Impact": "partial"}], "role": "CISA Coordinator", "version": "2.0.3"}}}], "title": "CISA ADP Vulnrichment", "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-10-13T16:16:13.460Z"}}]}}

{"dataType": "CVE_RECORD", "containers": {"adp": [{"title": "CISA ADP Vulnrichment", "metrics": [{"other": {"type": "ssvc", "content": {"id": "CVE-2026-107717", "role": "CISA Coordinator", "options": [{"Exploitation": "poc"}, {"Automatable": "yes"}, {"Technical Impact": "partial"}], "version": "2.0.3", "timestamp": "2026-10-13T16:15:40.228940Z"}}}], "references": [{"url": "https://github.com/masci/banks/security/advisories/GHSA-hmq2-7hp6-7crh", "tags": ["exploit"]}], "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-10-13T16:16:08.625Z"}}], "cna": {"title": "Banks: User-controlled prompt input can be parsed as privileged chat messages", "source": {"advisory": "GHSA-hmq2-7hp6-7crh", "discovery": "UNKNOWN"}, "metrics": [{"cvssV3_1": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 6.5, "attackVector": "NETWORK", "baseSeverity": "MEDIUM", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N", "integrityImpact": "LOW", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "NONE", "privilegesRequired": "NONE", "confidentialityImpact": "LOW"}}], "affected": [{"vendor": "masci", "product": "banks", "versions": [{"status": "affected", "version": "< 2.5.0"}]}], "references": [{"url": "https://github.com/masci/banks/security/advisories/GHSA-hmq2-7hp6-7crh", "name": "https://github.com/masci/banks/security/advisories/GHSA-hmq2-7hp6-7crh", "tags": ["x_refsource_CONFIRM"]}, {"url": "https://github.com/masci/banks/pull/78", "name": "https://github.com/masci/banks/pull/78", "tags": ["x_refsource_MISC"]}, {"url": "https://github.com/masci/banks/commit/02172b816fb84f6a824cc09a8aca7416f53c12cb", "name": "https://github.com/masci/banks/commit/02172b816fb84f6a824cc09a8aca7416f53c12cb", "tags": ["x_refsource_MISC"]}, {"url": "https://github.com/masci/banks/releases/tag/v2.5.0", "name": "https://github.com/masci/banks/releases/tag/v2.5.0", "tags": ["x_refsource_MISC"]}], "descriptions": [{"lang": "en", "value": "Banks generates meaningful LLM prompts using a simple template language. Prior to 2.5.0, Banks Prompt.chat_messages() attempts to parse every line of rendered template output as ChatMessage JSON. When an application renders untrusted data and passes the returned ChatMessage objects to an LLM provider, attacker-controlled JSON can cross the prompt boundary and become a system, assistant, or tool message because ChatMessage.role accepts arbitrary strings. This can override application instructions, alter the intended prompt structure, or confuse downstream tool and message handling. This issue is fixed in version 2.5.0."}], "problemTypes": [{"descriptions": [{"lang": "en", "type": "CWE", "cweId": "CWE-20", "description": "CWE-20: Improper Input Validation"}]}], "providerMetadata": {"orgId": "a0819718-46f1-4df5-94e2-005712e83aaa", "shortName": "GitHub_M", "dateUpdated": "2026-10-08T21:38:07.447Z"}}}, "cveMetadata": {"cveId": "CVE-2026-107717", "state": "PUBLISHED", "dateUpdated": "2026-10-13T16:16:13.460Z", "dateReserved": "2026-10-08T17:21:52.975Z", "assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa", "datePublished": "2026-10-08T21:38:07.447Z", "assignerShortName": "GitHub_M"}, "dataVersion": "5.2"}

{"affected": [{"affectedData": [{"product": "banks", "vendor": "masci", "versions": [{"status": "affected", "version": "< 2.5.0"}]}], "source": "security-advisories@github.com"}], "cveTags": [], "descriptions": [{"lang": "en", "value": "Banks generates meaningful LLM prompts using a simple template language. Prior to 2.5.0, Banks Prompt.chat_messages() attempts to parse every line of rendered template output as ChatMessage JSON. When an application renders untrusted data and passes the returned ChatMessage objects to an LLM provider, attacker-controlled JSON can cross the prompt boundary and become a system, assistant, or tool message because ChatMessage.role accepts arbitrary strings. This can override application instructions, alter the intended prompt structure, or confuse downstream tool and message handling. This issue is fixed in version 2.5.0."}], "id": "CVE-2026-107717", "lastModified": "2026-10-13T17:17:16.860", "metrics": {"cvssMetricV31": [{"cvssData": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "NONE", "baseScore": 6.5, "baseSeverity": "MEDIUM", "confidentialityImpact": "LOW", "integrityImpact": "LOW", "privilegesRequired": "NONE", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N", "version": "3.1"}, "exploitabilityScore": 3.9, "impactScore": 2.5, "source": "security-advisories@github.com", "type": "Secondary"}], "ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2026-107717", "options": [{"exploitation": "poc"}, {"automatable": "yes"}, {"technicalImpact": "partial"}], "role": "CISA Coordinator", "timestamp": "2026-10-13T16:15:40.228940Z", "version": "2.0.3"}}]}, "published": "2026-10-08T22:17:27.560", "references": [{"source": "security-advisories@github.com", "url": "https://github.com/masci/banks/commit/02172b816fb84f6a824cc09a8aca7416f53c12cb"}, {"source": "security-advisories@github.com", "url": "https://github.com/masci/banks/pull/78"}, {"source": "security-advisories@github.com", "url": "https://github.com/masci/banks/releases/tag/v2.5.0"}, {"source": "security-advisories@github.com", "url": "https://github.com/masci/banks/security/advisories/GHSA-hmq2-7hp6-7crh"}, {"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "url": "https://github.com/masci/banks/security/advisories/GHSA-hmq2-7hp6-7crh"}], "sourceIdentifier": "security-advisories@github.com", "vulnStatus": "Deferred", "weaknesses": [{"description": [{"lang": "en", "value": "CWE-20"}], "source": "security-advisories@github.com", "type": "Secondary"}]}

{"bugzilla": {"description": "banks: banks: Chat role injection via untrusted template input", "id": "2550680", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2550680"}, "csaw": false, "cvss3": {"cvss3_base_score": "6.5", "cvss3_scoring_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N", "status": "draft"}, "cwe": "CWE-501", "details": ["Banks generates meaningful LLM prompts using a simple template language. Prior to 2.5.0, Banks Prompt.chat_messages() attempts to parse every line of rendered template output as ChatMessage JSON. When an application renders untrusted data and passes the returned ChatMessage objects to an LLM provider, attacker-controlled JSON can cross the prompt boundary and become a system, assistant, or tool message because ChatMessage.role accepts arbitrary strings. This can override application instructions, alter the intended prompt structure, or confuse downstream tool and message handling. This issue is fixed in version 2.5.0.", "A flaw was found in banks. When generating chat messages for Large Language Models (LLMs), the library attempts to parse every rendered template line as structured data without restricting message roles. A remote attacker can exploit this flaw by submitting crafted input that is interpreted as privileged system, assistant, or tool messages. Consequently, an attacker can bypass prompt boundaries, override application instructions, and manipulate downstream model behavior."], "name": "CVE-2026-107717", "package_state": [{"cpe": "cpe:/a:redhat:exploit_intelligence:0", "fix_state": "Out of support scope", "package_name": "exploit-intelligence/vulnerability-analysis-rhel9", "product_name": "Exploit Intelligence"}, {"cpe": "cpe:/a:redhat:lightspeed_core", "fix_state": "Fix deferred", "package_name": "lightspeed-core/rag-tool-cpu-rhel9", "product_name": "Lightspeed Core"}, {"cpe": "cpe:/a:redhat:lightspeed_core", "fix_state": "Fix deferred", "package_name": "lightspeed-core/rag-tool-cuda-12.9-rhel9", "product_name": "Lightspeed Core"}, {"cpe": "cpe:/a:redhat:openshift_lightspeed", "fix_state": "Fix deferred", "package_name": "openshift-lightspeed/lightspeed-ocp-rag-rhel9", "product_name": "OpenShift Lightspeed"}, {"cpe": "cpe:/a:redhat:openshift_lightspeed", "fix_state": "Not affected", "package_name": "openshift-lightspeed/lightspeed-service-api-rhel9", "product_name": "OpenShift Lightspeed"}, {"cpe": "cpe:/a:redhat:openshift_lightspeed", "fix_state": "Not affected", "package_name": "openshift-lightspeed-tech-preview/lightspeed-rag-tool-rhel9", "product_name": "OpenShift Lightspeed"}, {"cpe": "cpe:/a:redhat:ansible_automation_platform:2", "fix_state": "Out of support scope", "package_name": "ansible-automation-platform-25/lightspeed-chatbot-rhel8", "product_name": "Red Hat Ansible Automation Platform 2"}], "public_date": "2026-10-08T21:38:07Z", "references": ["https://www.cve.org/CVERecord?id=CVE-2026-107717\nhttps://nvd.nist.gov/vuln/detail/CVE-2026-107717\nhttps://github.com/masci/banks/commit/02172b816fb84f6a824cc09a8aca7416f53c12cb\nhttps://github.com/masci/banks/pull/78\nhttps://github.com/masci/banks/releases/tag/v2.5.0\nhttps://github.com/masci/banks/security/advisories/GHSA-hmq2-7hp6-7crh"], "threat_severity": "Moderate"}

{"affected": [{"configurations": [{"platform": null, "status": "affected", "versions": {"scheme": "semver", "value": "[0,2.5.0)"}}], "enrichment": {"confidence": 100.0, "confidence_source": "matching", "scores": [{"score": 100.0, "source": "matching"}]}, "original": {"product": "banks", "source": "cna", "vendor": "masci"}, "product": "banks", "vendor": "masci"}], "created": "2026-10-08T22:30:18.465526+00:00", "updated": "2026-10-17T09:15:06.519254+00:00", "vendors": ["masci", "masci$PRODUCT$banks"]}