EUVD-2026-59957
GHSA-58jr-9c6g-55jq
Severity by source
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:N/VA:N/SC:H/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
AC:H because exploitation needs a non-default pooled-context plus per-request-loader pattern and prior cache priming; PR:N/UI:N as the attacker just issues requests; S:C and C:H for cross-tenant content disclosure, no integrity/availability impact.
Primary rating from Vendor (VulnCheck).
CVSS VectorVendor: VulnCheck
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:N/VA:N/SC:H/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
Lifecycle Timeline
4DescriptionCVE.org
Scriban before 7.0.0 fails to clear the CachedTemplates dictionary when TemplateContext.Reset() is called, allowing cached templates to persist across reused contexts. Attackers can exploit request-dependent ITemplateLoader implementations to access previously authorized template content from earlier renders without triggering TemplateLoader.Load() again.
AnalysisAI
Information disclosure and authorization bypass in Scriban (the .NET text templating engine) before 7.0.0 lets attackers retrieve previously authorized include-template content from earlier renders. Because TemplateContext.Reset() clears output, globals, cultures, and source files but never clears the CachedTemplates dictionary, applications that pool a TemplateContext across requests and use a request-, tenant-, or user-dependent ITemplateLoader will serve a stale cached template to a later, less-privileged render without re-invoking TemplateLoader.Load(). …
Unlock full vulnerability intelligence
- Risk assessment & exploitation conditions
- Attack chain visualization
- Remediation with exact patch versions
- Threat intelligence from 22 sources
- Personal watchlist & email alerts
Free forever · No credit card required
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata
Vulnerability AssessmentAI
| Exploitation | Exploitation requires a specific, concrete deployment pattern in the consuming application: a TemplateContext instance that is pooled and reused (rather than created fresh per request) with reliance on TemplateContext.Reset() for isolation, combined with an ITemplateLoader whose Load()/LoadAsync() returns request-, tenant-, or user-dependent content, and use of the 'include' function with a stable template path/name across those contexts. … Additional conditions and limiting factors are described in the full assessment. |
| Risk Assessment | The signals are genuinely mixed and should be read carefully. … Full risk analysis with EPSS, KEV, and SSVC signal comparison available after sign-in. |
| Exploit Scenario | In a multi-tenant web app that pools one TemplateContext and uses an ITemplateLoader returning per-request content, an admin request first renders '{{ include "profile" }}', priming CachedTemplates with the admin-only compiled template. A later guest/low-privilege request reusing the same context after Reset() re-evaluates the same include path, receives the cached admin template without any fresh Load()/authorization call, and reads content it was never entitled to. … |
| Remediation | Vendor-released patch: upgrade Scriban (and Scriban.Signed) to 7.0.0 or later, which clears CachedTemplates on Reset(); update the NuGet package reference and rebuild. … Detailed patch versions, workarounds, and compensating controls in full report. |
Recommended ActionAI
Within 24 hours, inventory all applications using Scriban versions before 7.0.0 and confirm whether they pool TemplateContext objects across requests; flag systems handling sensitive or multi-tenant data for immediate action. …
Sign in for detailed remediation steps and compensating controls.
Threat intelligence, references, and detailed analysis are available after sign-in.
Arbitrary CLR property writes in Scriban (the .NET templating engine) before 7.2.2 allow template code to mutate live ho
Sandbox escape in the Scriban .NET templating engine (all versions before 7.0.0) lets attacker-influenced templates read
Scriban template engine versions 3.0.0 through 7.2.5 expose any application accepting untrusted templates to complete CP
Uncontrolled resource consumption in Scriban's .NET templating engine allows any party who can submit template input to
Remote denial of service in Scriban before 6.6.0 allows unauthenticated attackers to crash the entire .NET hosting proce
Process-terminating stack overflow in Scriban's template parser affects all versions before 7.0.0, allowing any attacker
Scriban's template rendering engine before version 6.6.0 crashes the entire .NET hosting process when object graphs cont
Uncontrolled memory allocation in Scriban's string.pad_left and string.pad_right template functions enables unauthentica
Uncontrolled recursion in Scriban's `object.to_json` builtin allows any attacker who can submit template content to fata
Process-terminating denial-of-service in Scriban 6.6.0-7.2.0 allows any network-reachable attacker to crash a host .NET
Resource exhaustion in Scriban 3.0.0 through 7.2.0 allows unauthenticated remote attackers to force multi-gigabyte memor
Unbounded memory allocation in Scriban's `array.insert_at` built-in function allows any template author to crash the hos
Same technique Information Disclosure
View allShare
External POC / Exploit Code
Leaving vuln.today