Monitor vulnerabilities like this one.
Sign up free to get alerted when software you use is affected.
8.3
CVE-2026-74791: Scriban: Authorized data leaked due to reused template cache
CVE-2026-74791 · published 18 days ago
Summary
Scriban templates can cache authorized content, allowing unauthorized access to sensitive data. This issue affects applications that use Scriban with a pooled TemplateContext and an ITemplateLoader that provides request-dependent content. To mitigate this, ensure that TemplateContext is not reused across different requests and use a new instance for each request.
What to do
- Update scriban to version 7.0.0.
- Update scriban scriban to version 7.0.0 or later.
Affected software
| Ecosystem | Vendor | Product | Affected versions |
|---|---|---|---|
| nuget | – | scriban |
< 7.0.0 Fix: upgrade to 7.0.0
|
| – | scriban | scriban | < 7.0.0 |
Original advisory text
Scriban before 7.0.0 Authorization Bypass via Stale Include Cache
Scriban before 7.0.0 fails to clear the CachedTemplates dictionary when TemplateContext.Reset() is called, allowing cached templates to persist across reused contexts. Attackers can exploit request-dependent ITemplateLoader implementations to access previously authorized template content from earlier renders without triggering TemplateLoader.Load() again.
References
- https://github.com/scriban/scriban/security/advisories/GHSA-x6m9-38vm-2xhf
- https://github.com/advisories/GHSA-x6m9-38vm-2xhf
- https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/74xxx/CVE-2026-74791... Vendor Advisory
- https://nvd.nist.gov/vuln/detail/CVE-2026-74791 Vendor Advisory
- https://www.vulncheck.com/advisories/scriban-before-authorization-bypass-via-sta... Vendor Advisory
Severity
8.3
High
CVSS 3.1: 8.6 (GHSA)
CVSS 3.1: 8.6 (MITRE)
Exploitation
EPSS <1%
Type
CWE-226Sensitive Information in Resource Not Removed Before Reuse
Timeline
Published16 Aug 2026
Updated2 Sep 2026
First seen24 Mar 2026
Monitor software like this
Free during beta