{"description":"Trending threats, MITRE ATT\u0026CK coverage, and detection metadata. Fed continuously.","favicon":"https://feed.craftedsignal.io/favicon-32x32.png","feed_url":"https://feed.craftedsignal.io/products/scriban-6.6.0/feed.json","home_page_url":"https://feed.craftedsignal.io/","icon":"https://feed.craftedsignal.io/apple-touch-icon.png","items":[{"_cs_actors":[],"_cs_cpes":[],"_cs_cves":[{"cvss":8.6,"id":"CVE-2026-74791"}],"_cs_exploited":false,"_cs_has_poc":false,"_cs_poc_references":[],"_cs_products":["Scriban","Scriban (6.6.0)","Scriban (\u003c 6.6.0)"],"_cs_severities":["high"],"_cs_tags":[],"_cs_type":"advisory","_cs_vendors":[],"content_html":"\u003cp\u003eScriban, a popular templating engine for .NET, contains a vulnerability (CVE-2026-74791) in versions prior to 7.0.0. The issue stems from the failure to properly clear the \u003ccode\u003eCachedTemplates\u003c/code\u003e dictionary when the \u003ccode\u003eTemplateContext.Reset()\u003c/code\u003e method is invoked. This flaw allows cached templates to persist across different rendering contexts. In applications where \u003ccode\u003eITemplateLoader\u003c/code\u003e implementations are request-dependent, this behavior can be leveraged by an attacker to access template content that was intended for a different, potentially more privileged user or request context. Because the template is retrieved from the stale cache, the \u003ccode\u003eTemplateLoader.Load()\u003c/code\u003e method is not re-triggered, bypassing intended authorization checks that would typically occur during the loading phase. This vulnerability poses a significant risk of unauthorized information disclosure in multi-tenant or request-heavy applications.\u003c/p\u003e\n\u003ch2 id=\"impact\"\u003eImpact\u003c/h2\u003e\n\u003cp\u003eThe vulnerability allows for unauthorized access to sensitive information by serving cached template content across security boundaries. If an application relies on per-request authorization during the loading of templates, an attacker may be able to view content rendered for other users. This vulnerability is rated as high severity due to the potential for unauthorized data access without requiring user interaction or authentication.\u003c/p\u003e\n\u003ch2 id=\"recommendation\"\u003eRecommendation\u003c/h2\u003e\n\u003col\u003e\n\u003cli\u003eUpgrade all instances of the Scriban library to version 7.0.0 or higher to ensure the \u003ccode\u003eCachedTemplates\u003c/code\u003e dictionary is correctly reset.\u003c/li\u003e\n\u003cli\u003eAudit applications using Scriban that implement custom \u003ccode\u003eITemplateLoader\u003c/code\u003e logic, specifically checking if authorization checks are performed only during the \u003ccode\u003eLoad()\u003c/code\u003e method, as this will be bypassed for cached templates.\u003c/li\u003e\n\u003cli\u003eMonitor application logs for anomalous template rendering activity or unexpected data access patterns in environments leveraging reused \u003ccode\u003eTemplateContext\u003c/code\u003e objects.\u003c/li\u003e\n\u003c/ol\u003e\n","date_modified":"2026-08-16T14:26:55Z","date_published":"2026-08-16T14:26:38Z","id":"https://feed.craftedsignal.io/briefs/2026-08-scriban-cache-bypass/","summary":"Scriban versions before 7.0.0 fail to clear the CachedTemplates dictionary during TemplateContext.Reset(), potentially allowing unauthorized access to template content across reused contexts.","title":"Authorization Bypass in Scriban via Stale Template Cache","url":"https://feed.craftedsignal.io/briefs/2026-08-scriban-cache-bypass/"},{"_cs_actors":[],"_cs_cpes":[],"_cs_cves":[{"cvss":9.8,"id":"CVE-2026-73061"}],"_cs_exploited":false,"_cs_has_poc":false,"_cs_poc_references":[],"_cs_products":["Scriban","Scriban (3.0.0 through 7.2.5)","Scriban (6.6.0-7.2.0)","Scriban (6.6.0)"],"_cs_severities":["critical"],"_cs_tags":["vulnerability","dot-net","template-injection","access-control","sandbox-bypass","cve-2026-74790",".net","denial-of-service","scriban","cve-2026-74783"],"_cs_type":"advisory","_cs_vendors":["Scriban"],"content_html":"\u003cp\u003eScriban, a popular .NET template engine, contains a critical access-modifier bypass vulnerability (CVE-2026-73061) affecting the TypedObjectAccessor component. This flaw occurs in versions prior to 7.2.2 and enables template code to circumvent standard setter-visibility checks. By exploiting this, an attacker can write to CLR object properties that should be protected by private, internal, or init-only modifiers.\u003c/p\u003e\n\u003cp\u003eThe vulnerability is particularly severe because it allows for mass assignment on public-setter properties and the modification of protected object states. In a web application context, an attacker capable of providing or influencing template input can manipulate internal host object states, potentially leading to privilege escalation or unauthorized data modification within the host application. Given the ubiquity of Scriban in .NET-based enterprise applications, organizations using custom template rendering logic are at risk of state manipulation attacks.\u003c/p\u003e\n\u003ch2 id=\"attack-chain\"\u003eAttack Chain\u003c/h2\u003e\n\u003col\u003e\n\u003cli\u003eAttacker identifies an endpoint or application feature that accepts user-supplied templates for rendering via Scriban.\u003c/li\u003e\n\u003cli\u003eAttacker crafts a malicious template payload targeting the TypedObjectAccessor functionality.\u003c/li\u003e\n\u003cli\u003eThe template engine processes the user-provided input and invokes TypedObjectAccessor to resolve or set properties on the underlying host object.\u003c/li\u003e\n\u003cli\u003eDue to the lack of visibility checks in the vulnerable library, the engine fails to validate if the target property allows external modification.\u003c/li\u003e\n\u003cli\u003eThe attacker successfully writes to restricted properties, such as those marked internal or private.\u003c/li\u003e\n\u003cli\u003eThe application uses the manipulated object state in subsequent business logic, leading to privilege escalation, bypass of security constraints, or state corruption.\u003c/li\u003e\n\u003cli\u003eThe final objective is typically the compromise of application logic or unauthorized modification of data within the application memory space.\u003c/li\u003e\n\u003c/ol\u003e\n\u003ch2 id=\"impact\"\u003eImpact\u003c/h2\u003e\n\u003cp\u003eSuccessful exploitation allows attackers to bypass property setter constraints, leading to arbitrary property writes. This results in the potential for complete compromise of application state, unauthorized privilege elevation, or data manipulation. Given the nature of template engines in .NET frameworks, the impact is consistent with full application control for the affected process.\u003c/p\u003e\n\u003ch2 id=\"recommendation\"\u003eRecommendation\u003c/h2\u003e\n\u003col\u003e\n\u003cli\u003eUpgrade all instances of the Scriban library to version 7.2.2 or later to remediate CVE-2026-73061.\u003c/li\u003e\n\u003cli\u003ePerform a code audit on all application components that process user-supplied templates using Scriban.\u003c/li\u003e\n\u003cli\u003eImplement strict input validation or sandboxing for any templates sourced from untrusted users to prevent unauthorized access to the underlying .NET object model.\u003c/li\u003e\n\u003c/ol\u003e\n","date_modified":"2026-08-16T14:26:32Z","date_published":"2026-08-16T14:25:30Z","id":"https://feed.craftedsignal.io/briefs/2026-08-scriban-bypass/","summary":"Scriban versions prior to 7.2.2 contain an access-modifier bypass in TypedObjectAccessor that allows unauthorized modification of private, internal, or init-only CLR object properties via template injection.","title":"Access-Modifier Bypass in Scriban","url":"https://feed.craftedsignal.io/briefs/2026-08-scriban-bypass/"}],"language":"en","title":"CraftedSignal Threat Feed - Scriban (6.6.0)","version":"https://jsonfeed.org/version/1.1"}