Scriban .NET Template Engine Access-Modifier Bypass — CVE-2026-73061

Executive Summary

A critical access-modifier bypass vulnerability has been disclosed in Scriban, a widely used .NET scripting and templating library. Tracked as CVE-2026-73061 (CVSS v3.1: 9.8, CVSS v4.0: 9.3), the flaw exists in Scriban's TypedObjectAccessor component, which fails to enforce setter-visibility rules when template code writes to CLR object properties. Attackers who can supply user-controlled templates can write to private, internal, and init-only .NET object properties, corrupt live host application state, and potentially achieve full confidentiality and integrity compromise. All Scriban versions prior to 7.2.2 are affected.

Vulnerability Details

Technical Analysis

Scriban allows .NET applications to expose host objects to template authors for rendering. The TypedObjectAccessor class, responsible for property access, correctly controls read access but fails to enforce visibility restrictions on writes. When a template assigns a value to a property, the accessor does not verify whether the property's setter is public, private, internal, or init-only — it writes unconditionally.

Exploit Scenarios

Mass Assignment: An attacker-controlled template can enumerate and set any public-setter property on a host object, including security-sensitive fields like IsAdmin, Role, or Permissions.

Private/Internal Setter Bypass: Properties explicitly declared with private set or internal set in C# to enforce encapsulation can be overwritten from template code, violating the object's invariants.

Init-Only Bypass: C# 9+ init properties, designed to be immutable after construction, can be set by Scriban template code — defeating the language's immutability guarantees.

Live Object Corruption: Host objects modified during template rendering retain those modifications after rendering completes, meaning a single template execution can permanently alter application state for the duration of the process lifetime.

Attack Vector

Any application that:

1. Uses Scriban for template rendering, and
2. Exposes host .NET objects to user-controlled template content (web forms, API bodies, uploaded files, database-stored templates)

...is vulnerable to this attack without patching. The network attack vector with no authentication or user interaction required reflects that web-facing applications rendering user templates are the primary risk surface.

Affected Software

Note: A related denial-of-service vulnerability (CVE-2026-73062, CVSS 7.5 High) was published the same day, affecting Scriban 3.0.0–7.2.0 via the array multiplication operator. Upgrading to 7.2.2 addresses both.

Mitigation

Upgrade to Scriban 7.2.2 immediately. This is the only documented remediation — no workarounds are available for the root cause.

Interim Measures (If Upgrade Is Not Immediately Possible)

1. Restrict template authorship — prevent end users from supplying arbitrary template content if at all possible. Shift to a curated, pre-approved template library.
2. Sandbox exposed objects — expose only Data Transfer Objects (DTOs) with no sensitive properties to Scriban, rather than live domain/entity objects.
3. Audit template inputs — log all user-supplied template content for anomalous property assignment patterns.
4. Monitor object state post-render — add integrity assertions on sensitive objects after template rendering in high-risk code paths.

Detection

• Review all code paths where user-supplied strings are passed to Template.Parse() or Template.Render() with host object bindings
• Watch for unexpected property mutations on objects passed to Scriban rendering calls
• Audit NuGet dependency trees for Scriban packages below version 7.2.2

References

• GitHub Advisory GHSA-7jvp-hj45-2f2m
• NVD — CVE-2026-73061
• Scriban on NuGet
• TheHackerWire — Scriban Critical Access-Modifier Bypass