CVE-2026-124438 · Package
NO FIX YET · SEE WHAT TO DO
Scriban is a .NET template engine; before version 7.5.2, a template author can use array.map to reach the Target, Method and ReturnType of imported delegates through reflection member accessors. An attacker can read captured closure secrets and assembly paths and overwrite service properties.
first public Oct 24, 2026 · 1 source
Check it with your coding agent
It checks your repository and tells you if you’re affected, with the fix.
Applications that let template authors, including users or tenants, supply Scriban templates that run with imported delegates are exposed. Applications that only render fixed, developer-written templates are unlikely to be exposed. unknown whether the vendor advisory lists more affected flows.
Not affected if fixed-templates, no-user-templates
Who cares dotnet, scriban, templating
dotnet list package output7.5.2 or laterScriban before 7.5.2 contains an information disclosure and object manipulation vulnerability that allows template authors to access .NET internals of function values through reflection member accessors. Attackers can use array.map to read Target, Method, or ReturnType on imported delegates, exposing and overwriting service properties, captured closure secrets, and assembly paths.
This page as .md · .json · CVSS:4.0/AV:N/AC:H/AT:P/PR:N/UI:N/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
NVD data is provided by NIST and is public domain. Posts quoted belong to their authors.
Are you affected?
Tell InfraStack what you run. It checks this one, and every next one, against your stack.
Ask from here. InfraStack checks the affected versions against your stack and answers in your inbox.
InfraStack checks the affected versions against your stack and answers in Slack, with the evidence and the fix.