Executive brief
Scriban: Template Writes to Arbitrary CLR Properties via `TypedObjectAccessor` (Mass Assignment + `private` / `init` / `internal` Setter Bypass)
Affected products
- NuGet scriban
Junglewise Threat Intelligence
CVE-2026-73061: Scriban: Template Writes to Arbitrary CLR Properties via `TypedObjectAccessor` (Mass Assignment + `private` / `init` / `internal` Setter Byp
CVE-2026-73061 · Severity: medium · CVSS 4 · Published 2026-07-06
Technologies: scriban (NuGet). Vendors: NuGet.