The masci banks product generates LLM prompts using a template language that parses Tool JSON objects from {% completion %} blocks. In versions before 2.4.3, the import_path field in these objects is resolved via importlib.import_module(...) and getattr(...) without any allowlisting or sanitization, enabling attackers to specify any importable Python attribute, such as os.system or subprocess.getoutput. When the LLM emits a tool_calls entry matching the attacker-supplied tool name, the resolved callable is invoked with attacker-controlled arguments, resulting in arbitrary code execution. This vulnerability is distinct from CVE-2026-44209, which was fixed in 2.4.2 by sandboxing the environment; however, the unsafe import and getattr chain remained exploitable until fixed in 2.4.3. The malicious payload is plain text in the rendered template body, bypassing sandbox protections.

Successful exploitation allows an attacker to execute arbitrary code within the process hosting masci banks, leading to full compromise of confidentiality, integrity, and availability of the affected system. The CVSS 3.1 base score is 7.5 (High), reflecting network attack vector, high impact on confidentiality, integrity, and availability, and requiring low privileges but high attack complexity.

A fix is available in masci banks version 2.4.3. Users should upgrade to version 2.4.3 or later to remediate this vulnerability. No other mitigations are indicated or effective because the vulnerability involves unsafe dynamic imports without sanitization. Patch status is confirmed by the vendor advisory stating the issue is fixed in 2.4.3.