CVE-2026-73061: Scriban before 7.2.2 Arbitrary Property Write via TypedObjectAccessor
Scriban before 7.2.2 contains an access-modifier bypass vulnerability in TypedObjectAccessor that allows template code to write CLR object properties without setter-visibility checks. Attackers can modify properties with private, internal, or init-only setters, and perform mass assignment on public-setter properties, permanently altering live host objects after template rendering.
Affected Software
Event History
Frequently Asked Questions
What is the severity of CVE-2026-73061?
CVE-2026-73061 has a critical severity rating of 9.8.
How do I fix CVE-2026-73061?
To fix CVE-2026-73061, upgrade Scriban to version 7.2.2 or later.
What vulnerability does CVE-2026-73061 describe?
CVE-2026-73061 describes an access-modifier bypass vulnerability in Scriban that allows unauthorized property writes.
What are the risks associated with CVE-2026-73061?
The risks include allowing attackers to modify properties with restricted access, potentially leading to code execution or data tampering.
What versions of Scriban are affected by CVE-2026-73061?
CVE-2026-73061 affects all Scriban versions prior to 7.2.2.