Access-Modifier Bypass in Scriban

Scriban, a popular .NET template engine, contains a critical access-modifier bypass vulnerability (CVE-2026-73061) affecting the TypedObjectAccessor component. This flaw occurs in versions prior to 7.2.2 and enables template code to circumvent standard setter-visibility checks. By exploiting this, an attacker can write to CLR object properties that should be protected by private, internal, or init-only modifiers.

The vulnerability is particularly severe because it allows for mass assignment on public-setter properties and the modification of protected object states. In a web application context, an attacker capable of providing or influencing template input can manipulate internal host object states, potentially leading to privilege escalation or unauthorized data modification within the host application. Given the ubiquity of Scriban in .NET-based enterprise applications, organizations using custom template rendering logic are at risk of state manipulation attacks.

Attack Chain

1. Attacker identifies an endpoint or application feature that accepts user-supplied templates for rendering via Scriban.
2. Attacker crafts a malicious template payload targeting the TypedObjectAccessor functionality.
3. The template engine processes the user-provided input and invokes TypedObjectAccessor to resolve or set properties on the underlying host object.
4. Due to the lack of visibility checks in the vulnerable library, the engine fails to validate if the target property allows external modification.
5. The attacker successfully writes to restricted properties, such as those marked internal or private.
6. The application uses the manipulated object state in subsequent business logic, leading to privilege escalation, bypass of security constraints, or state corruption.
7. The final objective is typically the compromise of application logic or unauthorized modification of data within the application memory space.

Impact

Successful exploitation allows attackers to bypass property setter constraints, leading to arbitrary property writes. This results in the potential for complete compromise of application state, unauthorized privilege elevation, or data manipulation. Given the nature of template engines in .NET frameworks, the impact is consistent with full application control for the affected process.

Recommendation

1. Upgrade all instances of the Scriban library to version 7.2.2 or later to remediate CVE-2026-73061.
2. Perform a code audit on all application components that process user-supplied templates using Scriban.
3. Implement strict input validation or sandboxing for any templates sourced from untrusted users to prevent unauthorized access to the underlying .NET object model.