CVE-2026-74790: Scriban before 7.0.0 MemberFilter Bypass via TemplateContext Cache
Scriban before 7.0.0 caches TypedObjectAccessor by Type only without considering MemberFilter changes, allowing reused TemplateContext instances to expose members that should be hidden. Attackers can access filtered properties and fields by reusing a TemplateContext after tightening its MemberFilter, bypassing sandbox policies across requests or tenants.
Affected Software
Event History
Frequently Asked Questions
What is the severity of CVE-2026-74790?
CVE-2026-74790 has a severity rating of 9.1, categorized as critical.
How can I fix CVE-2026-74790?
To fix CVE-2026-74790, upgrade to Scriban version 7.0.0 or later, where the vulnerability is patched.
What type of access does CVE-2026-74790 allow for attackers?
CVE-2026-74790 allows attackers to access properties and fields that should be filtered and hidden.
Which versions of Scriban are affected by CVE-2026-74790?
CVE-2026-74790 affects all versions of Scriban prior to 7.0.0.
What is the main issue with CVE-2026-74790?
The main issue with CVE-2026-74790 is the improper caching of TemplateContext instances, leading to a bypass of MemberFilter restrictions.