Vulnerabilities for banks

First version without a known vulnerability: 2.4.5

Details

• GHSA-x8wg-4xgc-vr542026-09-02

  Banks: Path traversal in `DirectoryPromptRegistry.set()` allows arbitrary file write outside the registry root

  Fixed in: 2.4.5

• GHSA-gphh-9q3h-jgpp2026-05-08

  banks has Critical Remote Code Execution (RCE) via Jinja2 SSTI

  Fixed in: 2.4.2