Executive brief
Scriban, a popular text templating engine for .NET, contains a security flaw that can allow unauthorized access to sensitive data. When the engine is reused to process multiple templates, it may fail to properly enforce security filters, potentially exposing private object properties or allowing unauthorized data modifications. This could lead to data leaks or policy bypasses in applications that use Scriban to handle data from different users or tenants.
Technical details
A protection mechanism bypass exists in Scriban due to the way TemplateContext caches member accessors. The GetMemberAccessor method caches accessors by Type only, without accounting for changes in MemberFilter or MemberRenamer. When a TemplateContext is reused and a more restrictive MemberFilter is applied, the engine continues to use the previously cached, more permissive accessor. This allows an attacker to access or modify .NET object members that should be restricted by the current security policy. The vulnerability is rooted in TemplateContext.cs where the Reset method fails to clear the _memberAccessors cache. This issue is resolved in version 7.0.0.
Affected products
- scriban scriban < 7.0.0
- scriban Scriban.Signed < 7.0.0
Timeline
- 2026-03-22: disclosed
- 2026-03-24: advisory
- 2026-07-06: patched