Monitor vulnerabilities like this one.
Sign up free to get alerted when software you use is affected.
9.1
CVE-2026-74790: Scriban: Data exposure due to outdated cached accessors
CVE-2026-74790 · published 18 days ago
Summary
If you use Scriban to render templates with sensitive data, a bug can cause previously exposed data to remain accessible even after you tighten security settings. This happens when Scriban reuses a cached accessor to access data, ignoring updated security filters. To prevent this, make sure to properly reuse or reset Scriban TemplateContext instances when changing security settings.
What to do
- Update scriban to version 7.0.0.
- Update scriban scriban to version 7.0.0 or later.
Affected software
| Ecosystem | Vendor | Product | Affected versions |
|---|---|---|---|
| nuget | – | scriban |
< 7.0.0 Fix: upgrade to 7.0.0
|
| – | scriban | scriban | < 7.0.0 |
Original advisory text
Scriban before 7.0.0 MemberFilter Bypass via TemplateContext Cache
Scriban before 7.0.0 caches TypedObjectAccessor by Type only without considering MemberFilter changes, allowing reused TemplateContext instances to expose members that should be hidden. Attackers can access filtered properties and fields by reusing a TemplateContext after tightening its MemberFilter, bypassing sandbox policies across requests or tenants.
References
- https://github.com/scriban/scriban/security/advisories/GHSA-5wr9-m6jw-xx44
- https://github.com/advisories/GHSA-5wr9-m6jw-xx44
- https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/74xxx/CVE-2026-74790... Vendor Advisory
- https://nvd.nist.gov/vuln/detail/CVE-2026-74790 Vendor Advisory
- https://www.vulncheck.com/advisories/scriban-before-memberfilter-bypass-via-temp... Vendor Advisory
Severity
9.1
Critical
CVSS 3.1: 9.1 (GHSA)
CVSS 3.1: 9.1 (MITRE)
Exploitation
EPSS <1%
Type
CWE-693Protection Mechanism Failure
Timeline
Published16 Aug 2026
Updated2 Sep 2026
First seen24 Mar 2026
Monitor software like this
Free during beta