CVE-2026-73061
Received Received - Intake

Scriban TypedObjectAccessor Access Modifier Bypass Vulnerability

Publication date: 2026-08-16

Last updated on: 2026-08-16

Assigner: VulnCheck

Description
Scriban before 7.2.2 contains an access-modifier bypass vulnerability in TypedObjectAccessor that allows template code to write CLR object properties without setter-visibility checks. Attackers can modify properties with private, internal, or init-only setters, and perform mass assignment on public-setter properties, permanently altering live host objects after template rendering.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-08-16
Last Modified
2026-08-16
Generated
2026-08-16
AI Q&A
2026-08-16
EPSS Evaluated
N/A
NVD
CVE-2026-73061
EUVD
EUVD-2026-59947

Affected Vendors & Products

Showing 1 associated CPE
Vendor Product Version / Range
scriban scriban to 7.2.2 (exc)

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-284 The product does not restrict or incorrectly restricts access to a resource from an unauthorized actor.

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

Scriban before 7.2.2 has a vulnerability where template code can bypass access modifiers and write to CLR object properties without proper setter visibility checks. This allows attackers to modify properties marked as private, internal, or init-only, and perform mass assignment on public setters, permanently altering live host objects after rendering.

Detection Guidance

This vulnerability requires checking Scriban library versions in use. Inspect installed NuGet packages or assemblies for Scriban versions prior to 7.2.2. Commands may include checking package manifests or running 'dotnet list package' in .NET projects.

Impact Analysis

An attacker could exploit this to modify sensitive data in applications using Scriban, leading to unauthorized changes in system behavior, data corruption, or bypassing security controls. This could result in data breaches, privilege escalation, or application instability.

Compliance Impact

This vulnerability could lead to unauthorized data modifications, violating integrity and confidentiality requirements in GDPR and HIPAA. Non-compliance risks include fines, legal penalties, and loss of trust due to potential data breaches or tampering.

Mitigation Strategies

Upgrade Scriban to version 7.2.2 or later immediately. Review templates for unauthorized property modifications and restrict template execution permissions. Monitor for unexpected system changes post-rendering.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-73061. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart