CVE-2026-74790
CriticalCVSS 9.1Summary
Scriban before 7.0.0 caches TypedObjectAccessor by type only without considering MemberFilter changes, allowing reused TemplateContext instances to expose members that should be hidden. Attackers can access filtered properties and fields by reusing a TemplateContext after tightening its MemberFilter.
Risk Assessment
Risk of bypassing sandbox policies in multi-tenant applications, potentially leading to unauthorized access to data or functionality.
Recommendation
Update Scriban to version 7.0.0 or later to fix the TypedObjectAccessor caching issue.
Original NVD description (English source)
Scriban before 7.0.0 caches TypedObjectAccessor by Type only without considering MemberFilter changes, allowing reused TemplateContext instances to expose members that should be hidden. Attackers can access filtered properties and fields by reusing a TemplateContext after tightening its MemberFilter, bypassing sandbox policies across requests or tenants.