{"id":"CVE-2026-124438","kind":"vulnerability","aliases":["CVE-2026-124438"],"related":[],"title":"Scriban: template authors can read and overwrite .NET internals via reflection","description":"Scriban before 7.5.2 contains an information disclosure and object manipulation vulnerability that allows template authors to access .NET internals of function values through reflection member accessors. Attackers can use array.map to read Target, Method, or ReturnType on imported delegates, exposing and overwriting service properties, captured closure secrets, and assembly paths.","summary":"Scriban is a .NET template engine; before version 7.5.2, a template author can use array.map to reach the Target, Method and ReturnType of imported delegates through reflection member accessors. An attacker can read captured closure secrets and assembly paths and overwrite service properties.","severity":"critical","cvss":9.1,"epss":null,"exploited":false,"exploited_at":null,"products":[],"ecosystems":[],"tags":["dotnet","package","scriban","templating"],"not_affected_if":["fixed-templates","no-user-templates"],"how_to_check":"- Find the Scriban version in the project's lockfile or `dotnet list package` output\n- Check whether the application renders templates from untrusted or user-supplied input","fix":"- Scriban: move to `7.5.2` or later","status":"open","published_at":"2026-11-08T14:18:10+00:00","first_seen_at":"2026-11-08T14:48:39+00:00","triaged_at":"2026-11-08T14:48:55+00:00","updated_at":"2026-11-08T14:48:55+00:00","category":"package","confidence":0.6,"triage":{"at":"2026-11-08T14:48:55Z","model":"claude-haiku-5-5","output":{"fix":"- Scriban: move to `7.5.2` or later","reach":"unknown","title":"Scriban: template authors can read and overwrite .NET internals via reflection","impact":"high","summary":"Scriban is a .NET template engine; before version 7.5.2, a template author can use array.map to reach the Target, Method and ReturnType of imported delegates through reflection member accessors. An attacker can read captured closure secrets and assembly paths and overwrite service properties.","audience":"developers","category":"package","nicknames":[],"who_cares":["dotnet","scriban","templating"],"confidence":0.6,"fix_status":"available","needs_auth":"unknown","worst_case":"template author reads secrets and overwrites service properties","analyst_note":"Confirm the affected template flows and any auth requirement from the vendor advisory at github.com and the VulnCheck advisory.","how_to_check":"- Find the Scriban version in the project's lockfile or `dotnet list package` output\n- Check whether the application renders templates from untrusted or user-supplied input","plain_action":"","product_name":"","needs_analyst":true,"not_affected_if":["fixed-templates","no-user-templates"],"who_is_affected":"Applications that let template authors, including users or tenants, supply Scriban templates that run with imported delegates are exposed. Applications that only render fixed, developer-written templates are unlikely to be exposed. unknown whether the vendor advisory lists more affected flows.","user_interaction":"no","product_ecosystem":"","needs_special_setup":"unknown","severity_if_unknown":"critical"},"cost_usd":0.000725,"input_tokens":4604,"output_tokens":529,"severity_before":"critical"},"analyst_status":null,"analyst_note":null,"search":"'-124438':14A,17A '-2026':13A,16A '7.5.2':30B,67C 'access':81C 'accessor':50B,90C 'allow':77C 'array.map':36B,94C 'assembl':59B,113C 'attack':52B,91C 'author':3A,33B,79C 'captur':55B,109C 'closur':56B,110C 'contain':68C 'cve':12A,15A 'deleg':46B,103C 'disclosur':71C 'dotnet':18B 'engin':27B 'expos':104C 'function':85C 'import':45B,102C 'inform':70C 'intern':9A,83C 'manipul':74C 'member':49B,89C 'method':41B,98C 'net':8A,25B,82C 'object':73C 'overwrit':7A,62B,106C 'packag':19B 'path':60B,114C 'properti':64B,108C 'reach':38B 'read':5A,54B,96C 'reflect':11A,48B,88C 'returntyp':43B,100C 'scriban':1A,20B,22B,65C 'secret':57B,111C 'servic':63B,107C 'target':40B,97C 'templat':2A,21B,26B,32B,78C 'use':35B,93C 'valu':86C 'version':29B 'via':10A 'vulner':75C","nicknames":[],"mitigations":[],"who_affected":"Applications that let template authors, including users or tenants, supply Scriban templates that run with imported delegates are exposed. Applications that only render fixed, developer-written templates are unlikely to be exposed. unknown whether the vendor advisory lists more affected flows.","tier":"B","verified":{},"analyst_revisit_at":null,"fix_status":"available","audience":"developers","plain_action":null,"pkeys":[],"ptokens":[],"labels":["critical","dotnet","package","scriban","templating"],"campaign_type":null,"search_a":"'-124438':14A,17A '-2026':13A,16A 'author':3A 'cve':12A,15A 'intern':9A 'net':8A 'overwrit':7A 'read':5A 'reflect':11A 'scriban':1A 'templat':2A 'via':10A","search_b":"'7.5.2':30B 'accessor':50B 'array.map':36B 'assembl':59B 'attack':52B 'author':33B 'captur':55B 'closur':56B 'deleg':46B 'dotnet':18B 'engin':27B 'import':45B 'member':49B 'method':41B 'net':25B 'overwrit':62B 'packag':19B 'path':60B 'properti':64B 'reach':38B 'read':54B 'reflect':48B 'returntyp':43B 'scriban':20B,22B 'secret':57B 'servic':63B 'target':40B 'templat':21B,26B,32B 'use':35B 'version':29B","search_c":"'7.5.2':67C 'access':81C 'accessor':90C 'allow':77C 'array.map':94C 'assembl':113C 'attack':91C 'author':79C 'captur':109C 'closur':110C 'contain':68C 'deleg':103C 'disclosur':71C 'expos':104C 'function':85C 'import':102C 'inform':70C 'intern':83C 'manipul':74C 'member':89C 'method':98C 'net':82C 'object':73C 'overwrit':106C 'path':114C 'properti':108C 'read':96C 'reflect':88C 'returntyp':100C 'scriban':65C 'secret':111C 'servic':107C 'target':97C 'templat':78C 'use':93C 'valu':86C 'vulner':75C","cause_entry":null,"cause_path":null,"first_public_at":"2026-10-24T08:35:35+00:00","kev":null,"cvss_vector":"CVSS:4.0/AV:N/AC:H/AT:P/PR:N/UI:N/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","cvss_by":"disclosure@vulncheck.com","poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-124438","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-124438","severity":null,"published_at":"2026-11-08T14:18:10+00:00","modified_at":"2026-11-08T14:18:10+00:00","first_seen_at":"2026-11-08T14:48:39+00:00","fetched_at":"2026-11-08T14:48:39+00:00","note":null}],"documents":[{"id":102060,"url":"https://github.com/scriban/scriban/security/advisories/GHSA-hvr4-4p37-494f","title":"Vendor advisory: github.com","kind":"vendor","source":"nvd","publisher":"vendor","text":null,"published_at":"2026-10-24T08:35:35+00:00","relation":"advisory","confidence":null,"note":"Vendor advisory: github.com"},{"id":102061,"url":"https://www.vulncheck.com/advisories/scriban-before-7.5.2-delegate-target-exposure-via-array-map-member-access","title":"Third-party advisory: www.vulncheck.com","kind":"advisory","source":"nvd","publisher":"research","text":null,"published_at":null,"relation":"advisory","confidence":null,"note":"Third-party advisory: www.vulncheck.com"}],"exploit_sources":[],"notice":"Free to read, with fair use of about 60 pages a minute. For higher limits or API access: sales@infrastack.ai"}