Scriban < 7.5.2 (< 7.5.2) - CraftedSignal Threat Feedhttps://feed.craftedsignal.io/products/scriban--7.5.2--7.5.2/Trending threats, MITRE ATT&CK coverage, and detection metadata. Fed continuously.Hugoenhello@craftedsignal.iohello@craftedsignal.ioSun, 08 Nov 2026 17:30:12 +0000https://feed.craftedsignal.io/favicon-32x32.pngCraftedSignal Threat Feedhttps://feed.craftedsignal.io/3232https://feed.craftedsignal.io/favicon.svgScriban: Information disclosure and object manipulation vulnerability (CVE-2026-124438)https://feed.craftedsignal.io/briefs/2026-11-scriban-vulnerability/Sun, 08 Nov 2026 17:30:12 +0000hello@craftedsignal.iohttps://feed.craftedsignal.io/briefs/2026-11-scriban-vulnerability/Scriban versions before 7.5.2 contain an information disclosure and object manipulation vulnerability that allows template authors to access .NET internals of function values through reflection member accessors.Scriban before 7.5.2 allows template authors to use array.map to read Target, Method, or ReturnType on imported delegates via reflection member accessors. This can expose or overwrite service properties, captured closure secrets, and assembly paths.

]]>highadvisory