{"description":"Trending threats, MITRE ATT\u0026CK coverage, and detection metadata. Fed continuously.","favicon":"https://feed.craftedsignal.io/favicon-32x32.png","feed_url":"https://feed.craftedsignal.io/products/scriban--6.6.0/feed.json","home_page_url":"https://feed.craftedsignal.io/","icon":"https://feed.craftedsignal.io/apple-touch-icon.png","items":[{"_cs_actors":[],"_cs_cpes":[],"_cs_cves":[{"cvss":8.6,"id":"CVE-2026-74791"}],"_cs_exploited":false,"_cs_has_poc":false,"_cs_poc_references":[],"_cs_products":["Scriban","Scriban (6.6.0)","Scriban (\u003c 6.6.0)"],"_cs_severities":["high"],"_cs_tags":[],"_cs_type":"advisory","_cs_vendors":[],"content_html":"\u003cp\u003eScriban, a popular templating engine for .NET, contains a vulnerability (CVE-2026-74791) in versions prior to 7.0.0. The issue stems from the failure to properly clear the \u003ccode\u003eCachedTemplates\u003c/code\u003e dictionary when the \u003ccode\u003eTemplateContext.Reset()\u003c/code\u003e method is invoked. This flaw allows cached templates to persist across different rendering contexts. In applications where \u003ccode\u003eITemplateLoader\u003c/code\u003e implementations are request-dependent, this behavior can be leveraged by an attacker to access template content that was intended for a different, potentially more privileged user or request context. Because the template is retrieved from the stale cache, the \u003ccode\u003eTemplateLoader.Load()\u003c/code\u003e method is not re-triggered, bypassing intended authorization checks that would typically occur during the loading phase. This vulnerability poses a significant risk of unauthorized information disclosure in multi-tenant or request-heavy applications.\u003c/p\u003e\n\u003ch2 id=\"impact\"\u003eImpact\u003c/h2\u003e\n\u003cp\u003eThe vulnerability allows for unauthorized access to sensitive information by serving cached template content across security boundaries. If an application relies on per-request authorization during the loading of templates, an attacker may be able to view content rendered for other users. This vulnerability is rated as high severity due to the potential for unauthorized data access without requiring user interaction or authentication.\u003c/p\u003e\n\u003ch2 id=\"recommendation\"\u003eRecommendation\u003c/h2\u003e\n\u003col\u003e\n\u003cli\u003eUpgrade all instances of the Scriban library to version 7.0.0 or higher to ensure the \u003ccode\u003eCachedTemplates\u003c/code\u003e dictionary is correctly reset.\u003c/li\u003e\n\u003cli\u003eAudit applications using Scriban that implement custom \u003ccode\u003eITemplateLoader\u003c/code\u003e logic, specifically checking if authorization checks are performed only during the \u003ccode\u003eLoad()\u003c/code\u003e method, as this will be bypassed for cached templates.\u003c/li\u003e\n\u003cli\u003eMonitor application logs for anomalous template rendering activity or unexpected data access patterns in environments leveraging reused \u003ccode\u003eTemplateContext\u003c/code\u003e objects.\u003c/li\u003e\n\u003c/ol\u003e\n","date_modified":"2026-08-16T14:26:55Z","date_published":"2026-08-16T14:26:38Z","id":"https://feed.craftedsignal.io/briefs/2026-08-scriban-cache-bypass/","summary":"Scriban versions before 7.0.0 fail to clear the CachedTemplates dictionary during TemplateContext.Reset(), potentially allowing unauthorized access to template content across reused contexts.","title":"Authorization Bypass in Scriban via Stale Template Cache","url":"https://feed.craftedsignal.io/briefs/2026-08-scriban-cache-bypass/"}],"language":"en","title":"CraftedSignal Threat Feed - Scriban (\u003c 6.6.0)","version":"https://jsonfeed.org/version/1.1"}