The masci banks product generates LLM prompts using a template language that parses Tool JSON objects from {% completion %} blocks. In versions before 2.4.3, the import_path field from these JSON objects is resolved using importlib.import_module(...) and getattr(...) without any allowlist or sanitization, enabling arbitrary Python attribute access such as os.system or subprocess.getoutput. When the LLM emits a tool_calls entry matching the attacker-supplied tool name, the resolved callable is invoked with attacker-controlled arguments, resulting in arbitrary code execution. This vulnerability is distinct from a prior issue fixed in 2.4.2 and is specifically addressed by the fix in 2.4.3.

Successful exploitation allows an attacker to execute arbitrary code within the process hosting the banks application, leading to full confidentiality, integrity, and availability compromise of the affected system. The CVSS 3.1 base score is 7.5 (High), reflecting network attack vector, high impact on confidentiality, integrity, and availability, but requiring low privileges and high attack complexity.

A fix is available in masci banks version 2.4.3. Users should upgrade to version 2.4.3 or later to remediate this vulnerability. No other mitigations are indicated or effective since the vulnerability stems from unsafe dynamic imports without sanitization. Patch status is confirmed by the vendor advisory stating the issue is fixed in 2.4.3.