A critical access-control flaw in the Scriban .NET templating library lets template code write to CLR object properties that should be off-limits, mutating live host objects beyond the scope of the render operation.
What Is It
CVE-2026-73061 is an access-modifier bypass in Scriban's TypedObjectAccessor. Prior to version 7.2.2, the accessor writes CLR object properties without enforcing setter-visibility checks. Template code can therefore modify properties whose setters are declared private, internal, or init-only, and can perform mass assignment against properties with public setters. The changes are not scoped to the render operation; they persist on the live host object after template rendering completes.
The issue is classified as CWE-284 (Improper Access Control) and carries a CVSS 3.1 base score of 9.8 (Critical), vector CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H. A secondary CVSS 4.0 score of 9.3 (Critical) was also assigned. Both scoring sets indicate network attack vector, low complexity, no privileges, and no user interaction, with high confidentiality, integrity, and availability impact.
Why It Matters
Scriban is commonly embedded in applications that render user- or tenant-supplied templates. Where that is the case, the bypass converts template authorship into a write primitive against application state. Properties deliberately locked down with restricted setters, the kind used for identity, authorization, or configuration invariants, become writable, and mass assignment extends the reach to any exposed public-setter property. Because mutations survive rendering, an attacker can leave the host object in an altered state that later code paths trust.
No CISA KEV entry was supplied for this CVE, so there is no confirmation of active exploitation and no federal remediation deadline associated with it. Exploit maturity in the CVSS 4.0 vector is NOT_DEFINED.
What's Vulnerable
- Vendor/product: scriban / scriban
- Affected: all versions before 7.2.2 (semver, default status otherwise unaffected)
- Fixed: 7.2.2 and later
Patch Status
Upgrade to Scriban 7.2.2 or later. The maintainers published GitHub Security Advisory GHSA-7jvp-hj45-2f2m covering the issue. The NVD record was published 2026-08-16 and remains in Received status, sourced from [email protected].
Sources
- NVD, CVE-2026-73061: https://nvd.nist.gov/vuln/detail/CVE-2026-73061
- Scriban GitHub Security Advisory (GHSA-7jvp-hj45-2f2m): https://github.com/scriban/scriban/security/advisories/GHSA-7jvp-hj45-2f2m
- VulnCheck Advisory; Scriban arbitrary property write via TypedObjectAccessor: https://www.vulncheck.com/advisories/scriban-before-arbitrary-property-write-via-typedobjectaccessor