by Kastro
Paper/Archive/CVE-2026-74790

CVE-2026-74790

scriban scriban — Scriban before 7.0.0 MemberFilter Bypass via TemplateContext Cache

EPSS 0.5%public exploitCVSS 9.3
critical.is priorityof 100
46
CVSS 9.3 (CNA)9.3 / 10 × 3027.9Not in CISA KEV+300.0EPSS percentile 40.7.407 × 208.1Exploit: SSVC poc+1010.0SSVC exploitation: poc+100.0
Description · from the CVE record

Scriban before 7.0.0 caches TypedObjectAccessor by Type only without considering MemberFilter changes, allowing reused TemplateContext instances to expose members that should be hidden. Attackers can access filtered properties and fields by reusing a TemplateContext after tightening its MemberFilter, bypassing sandbox policies across requests or tenants.

Affected

ProductAffectedFixed inSource
scriban< 7.0.07.0.0CNA

Scores by source

VulnCheck (CNA)9.3CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N
VulnCheck (CNA)9.1CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N
CISA ADPSSVCExploitation: poc · Automatable: yes · Technical impact: total

References

exploitgithub.com/scriban/scriban/security/advisories/GHSA-5wr9-m6jw-xx44writeupvulncheck.com/advisories/scriban-before-memberfilter-bypass-via-templatecontext-cache