{"description":"Trending threats, MITRE ATT\u0026CK coverage, and detection metadata. Fed continuously.","favicon":"https://feed.craftedsignal.io/favicon-32x32.png","feed_url":"https://feed.craftedsignal.io/products/scriban--7.5.2--7.5.2/feed.json","home_page_url":"https://feed.craftedsignal.io/","icon":"https://feed.craftedsignal.io/apple-touch-icon.png","items":[{"_cs_actors":[],"_cs_cpes":[],"_cs_cves":[{"cvss":7.4,"id":"CVE-2026-124438"}],"_cs_exploited":false,"_cs_has_poc":false,"_cs_poc_references":[],"_cs_products":["Scriban \u003c 7.5.2 (\u003c 7.5.2)"],"_cs_severities":["high"],"_cs_tags":[],"_cs_type":"advisory","_cs_vendors":[],"content_html":"\u003cp\u003eScriban before 7.5.2 allows template authors to use \u003ccode\u003earray.map\u003c/code\u003e to read \u003ccode\u003eTarget\u003c/code\u003e, \u003ccode\u003eMethod\u003c/code\u003e, or \u003ccode\u003eReturnType\u003c/code\u003e on imported delegates via reflection member accessors. This can expose or overwrite service properties, captured closure secrets, and assembly paths.\u003c/p\u003e\n","date_modified":"2026-11-08T17:30:12Z","date_published":"2026-11-08T17:30:12Z","id":"https://feed.craftedsignal.io/briefs/2026-11-scriban-vulnerability/","summary":"Scriban versions before 7.5.2 contain an information disclosure and object manipulation vulnerability that allows template authors to access .NET internals of function values through reflection member accessors.","title":"Scriban: Information disclosure and object manipulation vulnerability (CVE-2026-124438)","url":"https://feed.craftedsignal.io/briefs/2026-11-scriban-vulnerability/"}],"language":"en","title":"CraftedSignal Threat Feed - Scriban \u003c 7.5.2 (\u003c 7.5.2)","version":"https://jsonfeed.org/version/1.1"}