Masci vulnerabilities
We track 4 vulnerabilities in Masci products. 4 are rated high or critical, and none are known to be exploited. The most recent was published on October 8, 2026.
Latest Masci vulnerabilities
- 7.3 High severity
banks: Improper Limitation of a Pathname to a Restricted Directory
Banks generates meaningful LLM prompts using a simple template language. Prior to 2.5.1, Banks DirectoryPromptRegistry does not reject symbolic links for index.json or discovered and existing .jinja prompt files. In an application where untrusted users can inf
- 7.5 High severity
banks: Improper Control of Generation of Code
Banks generates meaningful LLM prompts using a simple template language. In versions prior to 2.4.3, banks parses Tool JSON objects from the rendered body of {% completion %} blocks and later resolves their import_path field through importlib.import_module(...
- 7.5 High severity
banks: Improper Limitation of a Pathname to a Restricted Directory
Banks generates meaningful LLM prompts using a simple template language. In versions prior to 2.4.4, all four media filters (image, audio, video, document) in banks accept untrusted user input as file paths via Path(value) and pass them directly to open(file_p
- 7.5 High severity
banks: Improper Neutralization of Special Elements Used in a Template Engine
Banks generates meaningful LLM prompts using a template language that makes sense. Prior to 2.4.2, banks uses jinja2.Environment() (unsandboxed) to render prompt templates. Applications that pass user-supplied strings as the template argument to Prompt() are v