EUVD-2026-59947
GHSA-4279-f6cf-4g7r
Vulnerability Assessment
| Weakness |
CWE
OWASP Top 10:2025
A01:2025 - Broken Access Control
ASVS 5.0
V8 - Authorization Access control enforcement
MITRE ATT&CK
1 technique across 1 tactic: Defense Evasion The technique list with ATT&CK links and the kill-chain view is part of the Basic plan and up. |
Get an e-mail when this CVE is exploited, patched or re-scored. Free account.
Alert meAnalysisAIv1 – Aug 16, 2026
Arbitrary CLR property writes in Scriban (the .NET templating engine) before 7.2.2 allow template code to mutate live host objects passed into a TemplateContext, bypassing C
setter-visibility rules entirely. Any object pushed via the documented ScriptObject pattern becomes fully writable, so template authors can set private, internal, and init-only setters as well as mass-assign public ones (e.g. {{ user.is_admin = true }}), and the changes persist on the host object after Render() returns. Publicly available proof-of-concept steps exist in the GHSA advisory; no active exploitation is reported (not in CISA KEV) and no EPSS score was supplied.
Affected VersionsENISA
Affected Packages
Source: OSV (Open Source Vulnerabilities)
Affects your stack
Affects 1 package in nuget
Checking this CVE against your own stacks and servers is part of the Basic plan and up.
Know when Scriban gets its next vulnerability
- Watch products and get an email when something new is published
- Check this CVE against your own stack and servers
- Exploit and PoC references, threat intelligence from 22 sources
No credit card · 7-day full trial
Severity by source
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N
Primary rating from Vendor (VulnCheck) · only source for this CVE.
CVSS VectorVendor: VulnCheck
Lifecycle Timeline
2DescriptionCVE.org
Scriban before 7.2.2 contains an access-modifier bypass vulnerability in TypedObjectAccessor that allows template code to write CLR object properties without setter-visibility checks. Attackers can modify properties with private, internal, or init-only setters, and perform mass assignment on public-setter properties, permanently altering live host objects after template rendering.
Executive ViewAI
Scriban .NET templating engine versions before 7.2.2 contain a critical vulnerability allowing template code to bypass object access controls and modify sensitive application data; publicly available exploit code exists. Organizations using Scriban in production environments face immediate risk to application integrity and security policy enforcement, particularly those accepting external template sources. Immediate patching to version 7.2.2 is required to close this exposure.
Within 24 hours, identify all instances of Scriban versions before 7.2.2 in use across the organization and assess whether they process untrusted or externally-sourced templates. Within 7 days, upgrade all affected Scriban installations to version 7.2.2 or later, prioritizing systems that accept templates from external sources or untrusted authors. Within 30 days, complete organization-wide patching, conduct regression testing to validate template processing functionality, and review historical template audit logs for evidence of malicious object modifications.
Apply vendor patch.
Threat Intelligence Overview
NVD
CVE.org
EPSS
Vulnrichment
How this decision was reached
The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.
What every action level means
SSVC AssessmentENISA
Priority Score
Attack Technique
Authentication bypass attacks exploit flaws in the verification mechanisms that control access to systems and applications.
Sandbox escape in the Scriban .NET templating engine (all versions before 7.0.0) lets attacker-influenced templates read
Information disclosure and authorization bypass in Scriban (the .NET text templating engine) before 7.0.0 lets attackers
Scriban template engine versions 3.0.0 through 7.2.5 expose any application accepting untrusted templates to complete CP
Uncontrolled resource consumption in Scriban's .NET templating engine allows any party who can submit template input to
Remote denial of service in Scriban before 6.6.0 allows unauthenticated attackers to crash the entire .NET hosting proce
Process-terminating stack overflow in Scriban's template parser affects all versions before 7.0.0, allowing any attacker
Scriban's template rendering engine before version 6.6.0 crashes the entire .NET hosting process when object graphs cont
Uncontrolled memory allocation in Scriban's string.pad_left and string.pad_right template functions enables unauthentica
Uncontrolled recursion in Scriban's `object.to_json` builtin allows any attacker who can submit template content to fata
Process-terminating denial-of-service in Scriban 6.6.0-7.2.0 allows any network-reachable attacker to crash a host .NET
Resource exhaustion in Scriban 3.0.0 through 7.2.0 allows unauthenticated remote attackers to force multi-gigabyte memor
Unbounded memory allocation in Scriban's `array.insert_at` built-in function allows any template author to crash the hos
Exploit-DB