by Kastro
Paper/Archive/CVE-2026-124438

CVE-2026-124438

scriban scriban — Scriban before 7.5.2 Delegate Target Exposure via array.map Member Access

CVSS 9.1
critical.is priorityof 100
27
CVSS 9.1 (CNA)9.1 / 10 × 3027.3Not in CISA KEV+300.0No EPSS score.000 × 200.0No public exploit+100.0SSVC exploitation: unknown+100.0
Description · from the CVE record

Scriban before 7.5.2 contains an information disclosure and object manipulation vulnerability that allows template authors to access .NET internals of function values through reflection member accessors. Attackers can use array.map to read Target, Method, or ReturnType on imported delegates, exposing and overwriting service properties, captured closure secrets, and assembly paths.

Affected

ProductAffectedFixed inSource
scriban< 7.5.27.5.2CNA
scriban< 7.5.27.5.2CNA

Scores by source

VulnCheck (CNA)9.1CVSS:4.0/AV:N/AC:H/AT:P/PR:N/UI:N/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N
VulnCheck (CNA)7.4CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:N

References

advisorygithub.com/scriban/scriban/security/advisories/GHSA-hvr4-4p37-494fwriteupvulncheck.com/advisories/scriban-before-7.5.2-delegate-target-exposure-via-array-map-member-access