CVE-2026-61536

High [CVE-2026-61536] Arbitrary code execution via unsafe tool definition import

CVE-2026-61536Source published Jul 30, 2026Source updated Jul 30, 2026

Banks generates meaningful LLM prompts using a simple template language. In versions prior to 2.4.3, banks parses Tool JSON objects from the rendered body of {% completion %} blocks and later resolves their import_path field through importlib.import_module(...) + getattr(...) to obtain the callable that handles a tool call. There is no allowlist or sanitization on import_path, so any importable Python attribute (e.g. os.system, subprocess.getoutput) can be selected. When the LLM emits a tool_calls entry whose function.name matches the attacker-supplied tool name, the resolved callable is invoked with kwargs decoded from tool_call.function.arguments, yielding arbitrary code execution in the banks-hosting process. This is distinct from GHSA-gphh-9q3h-jgpp / CVE-2026-44209. That advisory…

Affected products in this advisory

• Exploit Intelligence
• Lightspeed Core
• OpenShift Lightspeed
• Red Hat Ansible Automation Platform 2

Source-reported affected versions

• < 2.4.3

Source-reported fixed versions

• 2.4.2
• 2.4.3

Mitigation guidance

• Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base, or stability.