{"action":"Upgrade banks to 2.5.0 or later.","affected":[{"fixed":"2.5.0","introduced":"0"}],"component":"banks","cve_ids":["CVE-2026-107717"],"ecosystem":"PyPI","epss":0.00335,"exploited":false,"fixed_versions":["2.5.0"],"ghsa_id":"GHSA-hmq2-7hp6-7crh","id":"tcs_01M5KFM2Z9KVR444RW08XDM8A3","modified_at":"2026-10-15T14:56:15.712699415Z","published_at":"2026-10-08T22:10:01Z","references":["https://osv.dev/vulnerability/GHSA-hmq2-7hp6-7crh","https://github.com/masci/banks/security/advisories/GHSA-hmq2-7hp6-7crh","https://github.com/masci/banks/pull/78","https://github.com/masci/banks/commit/02172b816fb84f6a824cc09a8aca7416f53c12cb","https://github.com/masci/banks","https://github.com/masci/banks/releases/tag/v2.5.0"],"severity":{"label":"medium","score":6.5},"sources":[{"source":"osv","source_id":"GHSA-hmq2-7hp6-7crh","url":"https://osv.dev/vulnerability/GHSA-hmq2-7hp6-7crh"}],"summary":"Banks: User-controlled prompt input can be parsed as privileged chat messages"}