Bug 2550680 (CVE-2026-107717)

Summary: CVE-2026-107717 banks: banks: Chat role injection via untrusted template input
Product: [Other] Security Response Reporter: OSIDB Bzimport <bzimport>
Component: vulnerabilityAssignee: Product Security DevOps Team <prodsec-dev>
Status: NEW --- QA Contact:
Severity: medium Docs Contact:
Priority: medium    
Version: unspecifiedCC: anpicker, bparees, dschmidt, ebourniv, hasun, ikhan, jfula, jlanda, jowilson, kshier, nyancey, ometelka, ptisnovs, rbobbitt, sbunciak, simaishi, stcannon, syedriko, xdharmai, yguenane
Target Milestone: ---Keywords: Security
Target Release: ---   
Hardware: All   
OS: Linux   
Whiteboard:
Fixed In Version: Doc Type: ---
Doc Text:
A flaw was found in banks. When generating chat messages for Large Language Models (LLMs), the library attempts to parse every rendered template line as structured data without restricting message roles. A remote attacker can exploit this flaw by submitting crafted input that is interpreted as privileged system, assistant, or tool messages. Consequently, an attacker can bypass prompt boundaries, override application instructions, and manipulate downstream model behavior.
 Story Points: ---
Clone Of: Environment:
Last Closed: Type: ---
Regression: --- Mount Type: ---
Documentation: --- CRM:
Verified Versions: Category: ---
oVirt Team: --- RHEL 7.3 requirements from Atomic Host:
Cloudforms Team: --- Target Upstream Version:
Embargoed:

Description OSIDB Bzimport 2026-10-13 16:41:48 UTC 
Banks generates meaningful LLM prompts using a simple template language. Prior to 2.5.0, Banks Prompt.chat_messages() attempts to parse every line of rendered template output as ChatMessage JSON. When an application renders untrusted data and passes the returned ChatMessage objects to an LLM provider, attacker-controlled JSON can cross the prompt boundary and become a system, assistant, or tool message because ChatMessage.role accepts arbitrary strings. This can override application instructions, alter the intended prompt structure, or confuse downstream tool and message handling. This issue is fixed in version 2.5.0.