high
advisory
Scriban: Information disclosure and object manipulation vulnerability (CVE-2026-124438)
Scriban versions before 7.5.2 contain an information disclosure and object manipulation vulnerability that allows template authors to access .NET internals of function values through reflection member accessors.
CVE search metadata
CVE search record: CVE-2026-124438. Severity: high. CVSS: 7.4. KEV: no. Product: Scriban < 7.5.2 (< 7.5.2). Brief: Scriban: Information disclosure and object manipulation vulnerability (CVE-2026-124438). Brief link: https://feed.craftedsignal.io/briefs/2026-11-scriban-vulnerability/
Triage facts
Revision 1- Applicability
- Scriban < 7.5.2 (< 7.5.2)
- Evidence
- Unknown
- Severity
- High
- Sources
- 1 public source
- Freshness
- Revision 1Nov 8, 17:30 UTC
- Vulnerabilities
- 1 CVE
- Source quality
- A2Roughly even chance
Scriban before 7.5.2 allows template authors to use array.map to read Target, Method, or ReturnType on imported delegates via reflection member accessors. This can expose or overwrite service properties, captured closure secrets, and assembly paths.