CVE-2026-124438: Scriban before 7.5.2 Delegate Target Exposure via array.map Member Access

Published Nov 8, 2026

Updated

Scriban before 7.5.2 contains an information disclosure and object manipulation vulnerability that allows template authors to access .NET internals of function values through reflection member accessors. Attackers can use array.map to read Target, Method, or ReturnType on imported delegates, exposing and overwriting service properties, captured closure secrets, and assembly paths.

Event History

Nov 8, 2026

CVE Published

via MITRE·01:15 PM

Data Sourced

via MITRE·01:15 PM

DescriptionSeverityWeakness

Data Sourced

via NVD·02:18 PM

DescriptionSeverityWeakness

Frequently Asked Questions

Which deployments are exposed?

Deployments that allow template authors to use array.map against imported delegates are exposed. The issue affects Scriban versions before 7.5.2.

What access does an attacker need?

An attacker needs the ability to author or supply a template that is processed by the application. No authentication, user interaction, or network-adjacent access requirement is indicated by the provided vector, but exploitation has high attack complexity.

What should be protected if templates cannot be updated immediately?

Avoid exposing imported delegates to templates, particularly where those delegates reference service properties or capture sensitive values. The vulnerable reflection access can expose or overwrite service properties, closure secrets, and assembly paths.

CVE-2026-124438: Scriban before 7.5.2 Delegate Target Exposure via array.map Member Access

Event History

Frequently Asked Questions

Which deployments are exposed?

What access does an attacker need?

What should be protected if templates cannot be updated immediately?

Company

Resources

Contact

Frequently Asked Questions

Which deployments are exposed?

What access does an attacker need?

What should be protected if templates cannot be updated immediately?