Banks generates meaningful LLM prompts using a simple template language. Prior to 2.5.0, Banks Prompt.chat_messages() attempts to parse every line of rendered template output as ChatMessage JSON. When an application renders untrusted data and passes the returned ChatMessage objects to an LLM provider, attacker-controlled JSON can cross the prompt boundary and become a system, assistant, or tool message because ChatMessage.role accepts arbitrary strings. This can override application instructions, alter the intended prompt structure, or confuse downstream tool and message handling. This issue is fixed in version 2.5.0.

Affected: PyPI: banks

## Summary

Banks' `Prompt.chat_messages()` method parses every rendered output line as a potential `ChatMessage` JSON object. If attacker-controlled template data renders to JSON such as `{"role":"system","content":"..."}`, Banks returns it as a privileged `system` message instead of treating it as plain user-controlled text.

Applications that render untrusted user input with `Prompt.chat_messages()` and pass the returned messages directly to an LLM provider may be vulnerable to chat role injection and prompt boundary bypass.

## Details

The issue is in `src/banks/prompt.py`:

```python messages: list[ChatMessage] = [] for line in rendered.strip().split("\n"): try: messages.append(ChatMessage.model_validate_json(line)) except ValidationError: # Ignore lines that are not a message pass

if not messages: # fallback, if there was no {% chat %} block in the template, # try to build a list of messages for the role "user" messages.append(chat_message_from_text(role="user", content=rendered)) ``` The method first renders the template, then attempts to parse each rendered line as a ChatMessage.

Because this parsing is applied to the final rendered output, user-controlled template variables can accidentally become trusted structured chat messages.

The ChatMessage model also accepts any string as the role in src/banks/types.py: ```python class ChatMessage(BaseModel): role: str…