Monitor vulnerabilities like this one. Sign up free to get alerted when software you use is affected.
9.9

Scriban: Arbitrary CLR Property Writes via Template

CVE-2026-73061 · published 18 days ago
Summary

Scriban, a templating engine, allows templates to write to any public CLR property of objects passed to it, potentially overwriting intended values. This can lead to unexpected behavior in applications. To mitigate this, ensure that sensitive properties are not exposed as public setters, and consider using Scriban's `MemberFilter` to control access to specific properties.

What to do
  • Update scriban to version 7.2.2.
  • Update scriban scriban to version 7.2.2 or later.
Affected software
Ecosystem VendorProductAffected versions
nuget – scriban <= 7.2.1
Fix: upgrade to 7.2.2
– scriban scriban < 7.2.2
Original advisory text
Scriban before 7.2.2 Arbitrary Property Write via TypedObjectAccessor
Scriban before 7.2.2 contains an access-modifier bypass vulnerability in TypedObjectAccessor that allows template code to write CLR object properties without setter-visibility checks. Attackers can modify properties with private, internal, or init-only setters, and perform mass assignment on public-setter properties, permanently altering live host objects after template rendering.
References
Severity
9.9 Critical
CVSS 4.0: 7.7 (GHSA)
CVSS 3.1: 9.8 (MITRE)
Exploitation
EPSS <1%
Type
CWE-284Improper Access Control
CWE-915Improperly Controlled Modification of Dynamically-Determined Object Attributes
Timeline
Published16 Aug 2026
Updated2 Sep 2026
First seen6 Jul 2026
Sources
CVE-2026-73061 · NVD
CVE-2026-73061 · MITRE
GHSA-7jvp-hj45-2f2m · GHSA
CVE-2026-73061 · OSV
Monitor software like this
Free during beta