CVE-2026-124438
Received Received - Intake

Scriban Template Reflection Information Disclosure

Publication date: 2026-11-08

Last updated on: 2026-11-08

Assigner: VulnCheck

Description
Scriban before 7.5.2 contains an information disclosure and object manipulation vulnerability that allows template authors to access .NET internals of function values through reflection member accessors. Attackers can use array.map to read Target, Method, or ReturnType on imported delegates, exposing and overwriting service properties, captured closure secrets, and assembly paths.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-11-08
Last Modified
2026-11-08
Generated
2026-11-08
AI Q&A
2026-11-08
EPSS Evaluated
N/A
NVD
CVE-2026-124438
EUVD
EUVD-2026-119562

Affected Vendors & Products

Showing 1 associated CPE
Vendor Product Version / Range
scriban scriban to 7.5.2 (exc)

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-200 The product exposes sensitive information to an actor that is not explicitly authorized to have access to that information.

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

This vulnerability in Scriban before 7.5.2 allows template authors to access .NET internals through reflection member accessors. Attackers can use array.map to read properties like Target, Method, or ReturnType on imported delegates, exposing sensitive data such as service properties, closure secrets, and assembly paths. This enables both information disclosure and object manipulation.

Detection Guidance

To detect this vulnerability, check the installed version of Scriban on your system. If you are using Scriban version 7.5.1 or earlier, your system is vulnerable. Run the command 'dotnet list package' for .NET projects or check package.json for Node.js projects to identify Scriban versions.

Impact Analysis

This vulnerability can lead to sensitive data exposure, unauthorized modifications to system properties, or manipulation of service configurations. Attackers could access connection strings, API keys, or deployment paths, potentially compromising the integrity and confidentiality of the application.

Compliance Impact

This vulnerability could lead to non-compliance with GDPR or HIPAA by exposing sensitive personal or health data. Unauthorized access to such data may result in legal penalties, loss of trust, and failure to meet regulatory requirements for data protection and confidentiality.

Mitigation Strategies

Immediately upgrade Scriban to version 7.5.2 or later. Review and restrict member access for function values in the GetMemberAccessor method. Audit templates for unauthorized access to .NET internals and remove any imported delegates that expose sensitive data.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-124438. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart

Security Radar

News mentioning this vulnerability
Loading related security news...