PyPI/banks CVE-2026-107716: high 7.3, EPSS 0.13%

Banks: Symlink traversal and arbitrary file disclosure/overwrite in DirectoryPromptRegistry

Action: Upgrade banks to 2.5.1 or later.

pip install banks==2.5.1

Affected

Fixed versions

Sources

• osv: GHSA-556j-vv39-8rqv
• nvd: CVE-2026-107716
• https://github.com/masci/banks/security/advisories/GHSA-556j-vv39-8rqv
• https://github.com/masci/banks/pull/79
• https://github.com/masci/banks/commit/23ed13e50b4e217693fa5f9c30943fac8a41582f
• https://github.com/masci/banks
• https://github.com/masci/banks/releases/tag/v2.5.1

CVE-2026-107716 · published 2026-10-08T22:10:07Z · modified 2026-10-15T14:55:55.950976679Z · JSON