Executive brief
Scriban, a popular text templating engine for .NET, contains a flaw where sensitive template data can be leaked between different users or requests. When the engine is reused to save performance, it fails to clear its internal cache of included files, meaning a guest user might see content intended only for an administrator. This could lead to the exposure of private data or internal system information in multi-tenant applications.
Technical details
A vulnerability exists in Scriban's `TemplateContext.Reset()` method, which fails to clear the `CachedTemplates` collection. In applications that pool `TemplateContext` objects and utilize an `ITemplateLoader` to resolve content dynamically (e.g., based on the current user or tenant), the `include` function may serve a previously cached template instead of fetching the appropriate version for the current request. This occurs because `IncludeFunction.Invoke()` calls `GetOrCreateTemplate()`, which prioritizes the stale cache over the `TemplateLoader.Load()` method. Attackers can exploit this to access template content authorized for a previous session. The issue is fixed in version 7.0.0.
Affected products
- scriban Scriban < 7.0.0
- scriban Scriban.Signed < 7.0.0
Timeline
- 2026-03-22: disclosed: Initial disclosure on GitHub
- 2026-03-24: advisory: GitHub Advisory published
- 2026-03-24: patched: Version 7.0.0 released