CVE-2026-73061
CriticalCVSS 9.8Summary
Scriban before 7.2.2 contains an access-modifier bypass vulnerability in TypedObjectAccessor that allows template code to write CLR object properties without setter-visibility checks. Attackers can modify properties with private, internal, or init-only setters, and perform mass assignment on public-setter properties, permanently altering live host objects after template rendering.
Risk Assessment
Risk of unauthorized modification of application objects, potentially leading to data integrity issues or privilege escalation.
Recommendation
Update Scriban to version 7.2.2 or later to fix the TypedObjectAccessor vulnerability.
Original NVD description (English source)
Scriban before 7.2.2 contains an access-modifier bypass vulnerability in TypedObjectAccessor that allows template code to write CLR object properties without setter-visibility checks. Attackers can modify properties with private, internal, or init-only setters, and perform mass assignment on public-setter properties, permanently altering live host objects after template rendering.