---
id: "CVE-2026-124438"
page: "https://infrastack.ai/live/CVE-2026-124438"
kind: "vulnerability"
aliases: ["CVE-2026-124438"]
title: "Scriban: template authors can read and overwrite .NET internals via reflection"
severity: "critical"
cvss: 9.1
epss: null
exploited: false
status: "open"
category: "package"
products: []
ecosystems: []
tags: ["dotnet", "package", "scriban", "templating"]
not_affected_if: ["fixed-templates", "no-user-templates"]
published_at: "2026-11-08T14:18:10+00:00"
first_seen_at: "2026-11-08T14:48:39+00:00"
updated_at: "2026-11-08T14:48:55+00:00"
sources: [{"source": "nvd", "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-124438", "first_seen_at": "2026-11-08T14:48:39+00:00"}]
exploit_sources: []
---

# Scriban: template authors can read and overwrite .NET internals via reflection

Link for people: https://infrastack.ai/live/CVE-2026-124438 (this .md is for agents)

Scriban is a .NET template engine; before version 7.5.2, a template author can use array.map to reach the Target, Method and ReturnType of imported delegates through reflection member accessors. An attacker can read captured closure secrets and assembly paths and overwrite service properties.

_Summary, check and fix written by a model from the sources; labelled as such._

## How to check

- Find the Scriban version in the project's lockfile or `dotnet list package` output
- Check whether the application renders templates from untrusted or user-supplied input

## Fix

- Scriban: move to `7.5.2` or later

## Timeline

- 2026-11-08T14:48:39+00:00 nvd https://nvd.nist.gov/vuln/detail/CVE-2026-124438

## Documents

- [advisory] Vendor advisory: github.com https://github.com/scriban/scriban/security/advisories/GHSA-hvr4-4p37-494f
- [advisory] Third-party advisory: www.vulncheck.com https://www.vulncheck.com/advisories/scriban-before-7.5.2-delegate-target-exposure-via-array-map-member-access

## From the sources

Scriban before 7.5.2 contains an information disclosure and object manipulation vulnerability that allows template authors to access .NET internals of function values through reflection member accessors. Attackers can use array.map to read Target, Method, or ReturnType on imported delegates, exposing and overwriting service properties, captured closure secrets, and assembly paths.

---

_Free to read, with fair use of about 60 pages a minute. For higher limits or API access: sales@infrastack.ai_