Description
DirectoryPromptRegistry in banks did not reject symbolic links for index.json or for .jinja prompt files (CWE-59, CWE-22). Where untrusted users can influence a prompt directory, for example through an extracted archive or a shared repository, a link pointing outside the registry root lets get() and _scan() disclose a file and set() overwrite one. Fixed in 2.5.1 (PR #79).
CVSS Vector
Primary assessmentGitHub CNA · 7.3 High
CVSS:4.0/AV:L/AC:L/AT:P/PR:L/UI:N/VC:H/VI:H/VA:L/SC:N/SI:N/SA:NAV: LocalAC: LowAT: PresentPR: LowUI: NoneVC: HighVI: HighVA: LowSC: NoneSI: NoneSA: None
Disclosure Status
- Affected
- banks before 2.5.1
- Patch status
- Fixed in 2.5.1
- Vendor response
- Maintainer merged the fix (PR #79) and published GHSA-556j-vv39-8rqv
- Primary score source
- GitHub CNA
References
- CVE.org Record
- GitHub Security Advisory GHSA-556j-vv39-8rqv
- Fix: prevent symlinks in the prompt registry (PR #79)
- Fix commit 23ed13e
- banks 2.5.1 release
- NVD — National Vulnerability Database
- MITRE CVE Entry
Record Verification
CreditThe GitHub advisory GHSA-556j-vv39-8rqv credits Sevban DÖNMEZ (jankesec) as reporter
PublishedThe CVE record was published on 2026-10-08
CheckedMetadata last checked against the CVE Services record on 2026-10-30
Disclosure Timeline
2026-09-10Fix merged — The maintainer merged the change that rejects symbolic links in the prompt registry (PR #79). Source ↗
2026-10-08Published — GitHub, as CNA, published the CVE record and advisory GHSA-556j-vv39-8rqv. Source ↗
2026-10-09Record update — CISA added its Vulnrichment (SSVC) assessment to the CVE record.
2026-10-30Site verification — jankesec checked the CVE record, score, affected versions, and references.