PT-2026-39237 · Banks · Banks

Anandakrishnasv · CVE-2026-44209 · Published 2026-05-08 · Updated 2026-07-13

Positive Technologies (AI Summary)

CVSS v3.1

7.5

High

Base vector

AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions banks versions prior to 2.4.2

Description Server-Side Template Injection (SSTI) occurs when applications pass user-supplied strings directly as template arguments to the Prompt() function. This happens because the software uses jinja2.Environment() in an unsandboxed environment to render prompt templates, allowing a remote attacker to achieve Remote Code Execution (RCE) on the host system. SSTI is a flaw where an attacker injects malicious code into a template that is then executed by the server.

Recommendations Update to version 2.4.2. As a temporary workaround, avoid passing user-supplied strings as the template argument to the Prompt() function.

Exploit

Fix

RCE

Weakness Enumeration

CWE-917

CWE-1336

Related Identifiers

CVE-2026-44209

GHSA-GPHH-9Q3H-JGPP

PYSEC-2026-2390

Affected Products

Banks

References · 14

• 🔥 https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/44xxx/CVE-2026-44209.json · Exploit
• 🔥 https://github.com/masci/banks/security/advisories/GHSA-gphh-9q3h-jgpp · Exploit
• https://osv.dev/vulnerability/CVE-2026-44209 · Vendor Advisory
• https://osv.dev/vulnerability/PYSEC-2026-2390 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2026-44209 · Security Note
• https://osv.dev/vulnerability/GHSA-gphh-9q3h-jgpp · Vendor Advisory
• https://github.com/masci/banks · Note
• https://github.com/masci/banks/pull/74 · Note
• https://t.me/cveNotify/180288 · Telegram Post
• https://bugzilla.redhat.com/show_bug.cgi?id=2481713 · Note
• https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-44209.json · Note
• https://github.com/advisories/GHSA-gphh-9q3h-jgpp · Note
• https://pypi.org/project/banks · Note
• https://access.redhat.com/security/cve/CVE-2026-44209 · Note