Impact

The vulnerability allows for unauthorized access to sensitive information by serving cached template content across security boundaries. If an application relies on per-request authorization during the loading of templates, an attacker may be able to view content rendered for other users. This vulnerability is rated as high severity due to the potential for unauthorized data access without requiring user interaction or authentication.

Recommendation

1. Upgrade all instances of the Scriban library to version 7.0.0 or higher to ensure the CachedTemplates dictionary is correctly reset.
2. Audit applications using Scriban that implement custom ITemplateLoader logic, specifically checking if authorization checks are performed only during the Load() method, as this will be bypassed for cached templates.
3. Monitor application logs for anomalous template rendering activity or unexpected data access patterns in environments leveraging reused TemplateContext objects.

The vulnerability is particularly severe because it allows for mass assignment on public-setter properties and the modification of protected object states. In a web application context, an attacker capable of providing or influencing template input can manipulate internal host object states, potentially leading to privilege escalation or unauthorized data modification within the host application. Given the ubiquity of Scriban in .NET-based enterprise applications, organizations using custom template rendering logic are at risk of state manipulation attacks.

Attack Chain

1. Attacker identifies an endpoint or application feature that accepts user-supplied templates for rendering via Scriban.
2. Attacker crafts a malicious template payload targeting the TypedObjectAccessor functionality.
3. The template engine processes the user-provided input and invokes TypedObjectAccessor to resolve or set properties on the underlying host object.
4. Due to the lack of visibility checks in the vulnerable library, the engine fails to validate if the target property allows external modification.
5. The attacker successfully writes to restricted properties, such as those marked internal or private.
6. The application uses the manipulated object state in subsequent business logic, leading to privilege escalation, bypass of security constraints, or state corruption.
7. The final objective is typically the compromise of application logic or unauthorized modification of data within the application memory space.

Impact

Successful exploitation allows attackers to bypass property setter constraints, leading to arbitrary property writes. This results in the potential for complete compromise of application state, unauthorized privilege elevation, or data manipulation. Given the nature of template engines in .NET frameworks, the impact is consistent with full application control for the affected process.

Recommendation

1. Upgrade all instances of the Scriban library to version 7.2.2 or later to remediate CVE-2026-73061.
2. Perform a code audit on all application components that process user-supplied templates using Scriban.
3. Implement strict input validation or sandboxing for any templates sourced from untrusted users to prevent unauthorized access to the underlying .NET object model.