Description
Scriban before 7.2.2 contains an access-modifier bypass vulnerability in TypedObjectAccessor that allows template code to write CLR object properties without setter-visibility checks. Attackers can modify properties with private, internal, or init-only setters, and perform mass assignment on public-setter properties, permanently altering live host objects after template rendering.
CVSS 9.8EPSS 0.302%Risque 1.01
Voir la source- Publication
- 2026-08-16 14:16:55
- Versions concernées
- <7.2.2
- Type
- Bibliothèque
- Dernière modification
- 2026-08-17 18:18:13
- Vecteur
- CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H