Description
Scriban before 7.2.2 contains an access-modifier bypass vulnerability in TypedObjectAccessor that allows template code to write CLR object properties without setter-visibility checks. Attackers can modify properties with private, internal, or init-only setters, and perform mass assignment on public-setter properties, permanently altering live host objects after template rendering.
CVSS 9.8EPSS 0.302%Risk 1.01
View source- Published
- 2026-08-16 14:16:55
- Affected versions
- <7.2.2
- Type
- Library
- Last modified
- 2026-08-17 18:18:13
- Vector
- CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H