{"description":"Trending threats, MITRE ATT\u0026CK coverage, and detection metadata. Fed continuously.","favicon":"https://feed.craftedsignal.io/favicon-32x32.png","feed_url":"https://feed.craftedsignal.io/products/scriban-3.0.0-through-7.2.5/feed.json","home_page_url":"https://feed.craftedsignal.io/","icon":"https://feed.craftedsignal.io/apple-touch-icon.png","items":[{"_cs_actors":[],"_cs_cpes":[],"_cs_cves":[{"cvss":9.8,"id":"CVE-2026-73061"}],"_cs_exploited":false,"_cs_has_poc":false,"_cs_poc_references":[],"_cs_products":["Scriban","Scriban (3.0.0 through 7.2.5)","Scriban (6.6.0-7.2.0)","Scriban (6.6.0)"],"_cs_severities":["critical"],"_cs_tags":["vulnerability","dot-net","template-injection","access-control","sandbox-bypass","cve-2026-74790",".net","denial-of-service","scriban","cve-2026-74783"],"_cs_type":"advisory","_cs_vendors":["Scriban"],"content_html":"\u003cp\u003eScriban, a popular .NET template engine, contains a critical access-modifier bypass vulnerability (CVE-2026-73061) affecting the TypedObjectAccessor component. This flaw occurs in versions prior to 7.2.2 and enables template code to circumvent standard setter-visibility checks. By exploiting this, an attacker can write to CLR object properties that should be protected by private, internal, or init-only modifiers.\u003c/p\u003e\n\u003cp\u003eThe vulnerability is particularly severe because it allows for mass assignment on public-setter properties and the modification of protected object states. In a web application context, an attacker capable of providing or influencing template input can manipulate internal host object states, potentially leading to privilege escalation or unauthorized data modification within the host application. Given the ubiquity of Scriban in .NET-based enterprise applications, organizations using custom template rendering logic are at risk of state manipulation attacks.\u003c/p\u003e\n\u003ch2 id=\"attack-chain\"\u003eAttack Chain\u003c/h2\u003e\n\u003col\u003e\n\u003cli\u003eAttacker identifies an endpoint or application feature that accepts user-supplied templates for rendering via Scriban.\u003c/li\u003e\n\u003cli\u003eAttacker crafts a malicious template payload targeting the TypedObjectAccessor functionality.\u003c/li\u003e\n\u003cli\u003eThe template engine processes the user-provided input and invokes TypedObjectAccessor to resolve or set properties on the underlying host object.\u003c/li\u003e\n\u003cli\u003eDue to the lack of visibility checks in the vulnerable library, the engine fails to validate if the target property allows external modification.\u003c/li\u003e\n\u003cli\u003eThe attacker successfully writes to restricted properties, such as those marked internal or private.\u003c/li\u003e\n\u003cli\u003eThe application uses the manipulated object state in subsequent business logic, leading to privilege escalation, bypass of security constraints, or state corruption.\u003c/li\u003e\n\u003cli\u003eThe final objective is typically the compromise of application logic or unauthorized modification of data within the application memory space.\u003c/li\u003e\n\u003c/ol\u003e\n\u003ch2 id=\"impact\"\u003eImpact\u003c/h2\u003e\n\u003cp\u003eSuccessful exploitation allows attackers to bypass property setter constraints, leading to arbitrary property writes. This results in the potential for complete compromise of application state, unauthorized privilege elevation, or data manipulation. Given the nature of template engines in .NET frameworks, the impact is consistent with full application control for the affected process.\u003c/p\u003e\n\u003ch2 id=\"recommendation\"\u003eRecommendation\u003c/h2\u003e\n\u003col\u003e\n\u003cli\u003eUpgrade all instances of the Scriban library to version 7.2.2 or later to remediate CVE-2026-73061.\u003c/li\u003e\n\u003cli\u003ePerform a code audit on all application components that process user-supplied templates using Scriban.\u003c/li\u003e\n\u003cli\u003eImplement strict input validation or sandboxing for any templates sourced from untrusted users to prevent unauthorized access to the underlying .NET object model.\u003c/li\u003e\n\u003c/ol\u003e\n","date_modified":"2026-08-16T14:26:32Z","date_published":"2026-08-16T14:25:30Z","id":"https://feed.craftedsignal.io/briefs/2026-08-scriban-bypass/","summary":"Scriban versions prior to 7.2.2 contain an access-modifier bypass in TypedObjectAccessor that allows unauthorized modification of private, internal, or init-only CLR object properties via template injection.","title":"Access-Modifier Bypass in Scriban","url":"https://feed.craftedsignal.io/briefs/2026-08-scriban-bypass/"}],"language":"en","title":"CraftedSignal Threat Feed - Scriban (3.0.0 Through 7.2.5)","version":"https://jsonfeed.org/version/1.1"}