Banks · Banks · CVE-2026-44209
**Name of the Vulnerable Software and Affected Versions**
banks versions prior to 2.4.2
**Description**
Server-Side Template Injection (SSTI) occurs when applications pass user-supplied strings directly as template arguments to the `Prompt()` function. This happens because the software uses `jinja2.Environment()` in an unsandboxed environment to render prompt templates, allowing a remote attacker to achieve Remote Code Execution (RCE) on the host system. SSTI is a flaw where an attacker injects malicious code into a template that is then executed by the server.
**Recommendations**
Update to version 2.4.2.
As a temporary workaround, avoid passing user-supplied strings as the template argument to the `Prompt()` function.