SYS::ONLINE
Wasteland.
Briefs2197
Issues24
SinceFeb 2026
LIVE
⚡ Active KEV CVE-2026-73061 2026-08-16

CVE-2026-73061: Scriban Template Engine Access-Modifier Bypass Allows Arbitrary Property Writes

"A critical access-control flaw in the Scriban .NET templating library lets template code write to CLR object properties that should be off-limits, mutating live host objects beyond the scope of the render operation."

A critical access-control flaw in the Scriban .NET templating library lets template code write to CLR object properties that should be off-limits, mutating live host objects beyond the scope of the render operation.

What Is It

CVE-2026-73061 is an access-modifier bypass in Scriban's TypedObjectAccessor. Prior to version 7.2.2, the accessor writes CLR object properties without enforcing setter-visibility checks. Template code can therefore modify properties whose setters are declared private, internal, or init-only, and can perform mass assignment against properties with public setters. The changes are not scoped to the render operation; they persist on the live host object after template rendering completes.

The issue is classified as CWE-284 (Improper Access Control) and carries a CVSS 3.1 base score of 9.8 (Critical), vector CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H. A secondary CVSS 4.0 score of 9.3 (Critical) was also assigned. Both scoring sets indicate network attack vector, low complexity, no privileges, and no user interaction, with high confidentiality, integrity, and availability impact.

Why It Matters

Scriban is commonly embedded in applications that render user- or tenant-supplied templates. Where that is the case, the bypass converts template authorship into a write primitive against application state. Properties deliberately locked down with restricted setters, the kind used for identity, authorization, or configuration invariants, become writable, and mass assignment extends the reach to any exposed public-setter property. Because mutations survive rendering, an attacker can leave the host object in an altered state that later code paths trust.

No CISA KEV entry was supplied for this CVE, so there is no confirmation of active exploitation and no federal remediation deadline associated with it. Exploit maturity in the CVSS 4.0 vector is NOT_DEFINED.

What's Vulnerable

Patch Status

Upgrade to Scriban 7.2.2 or later. The maintainers published GitHub Security Advisory GHSA-7jvp-hj45-2f2m covering the issue. The NVD record was published 2026-08-16 and remains in Received status, sourced from [email protected].

Sources