Is CVE-2026-124438 exploited in the wild?

No. Junglewise Threat Intelligence has no report of CVE-2026-124438 being exploited in the wild.

How severe is CVE-2026-124438?

High severity, with a CVSS score of 7.4, published 8 November 2026.

Which products and versions are affected?

Scriban before 7.5.2; Scriban.Signed before 7.5.2.

Is there a fix for CVE-2026-124438?

Yes: fixed in Scriban 7.5.2, Scriban.Signed 7.5.2. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

How is CVE-2026-124438 attacked?

It is attacked over the network, in a software library.

Am I affected by CVE-2026-124438?

Check whether you run Scriban or Scriban.Signed at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2026-124438: Scriban information disclosure and object manipulation via reflection

CVE-2026-124438 · Severity: high · CVSS 7.4 · Published 2026-11-08

Scriban is a templating engine used to render dynamic content with user-provided templates. Versions before 7.5.2 allow template authors to exploit reflection mechanisms to read and modify sensitive data—such as connection strings, API keys, and service configuration—that the host application exposed indirectly through function imports. An attacker submitting a malicious template can extract these secrets and corrupt application state.

Technologies: Scriban, Scriban.Signed. Vendors: Scriban.

Quick answers

Is CVE-2026-124438 exploited in the wild?: No. Junglewise Threat Intelligence has no report of CVE-2026-124438 being exploited in the wild.
How severe is CVE-2026-124438?: High severity, with a CVSS score of 7.4, published 8 November 2026.
Which products and versions are affected?: Scriban before 7.5.2; Scriban.Signed before 7.5.2.
Is there a fix for CVE-2026-124438?: Yes: fixed in Scriban 7.5.2, Scriban.Signed 7.5.2. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
How is CVE-2026-124438 attacked?: It is attacked over the network, in a software library.
Am I affected by CVE-2026-124438?: Check whether you run Scriban or Scriban.Signed at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

How to fix

Fixed in: Scriban 7.5.2, Scriban.Signed 7.5.2

Technical details

The vulnerability stems from TemplateContext.GetMemberAccessor() returning a reflection accessor for function wrapper objects (DelegateCustomFunction, DynamicCustomFunction), exposing their public members including Target, Method, and ReturnType. Attackers bypass the normal function-call mechanism by using array.map to read these members as raw objects, then recursively access and modify properties of service instances or captured closures. The attack requires network access and works against any host importing a delegate via ScriptObject.Import(), with no user interaction needed beyond template submission.

Affected products

Scriban Scriban before 7.5.2
Scriban Scriban.Signed before 7.5.2

Timeline

2026-10-24: disclosed
2026-11-08: advisory

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.