Description

Scriban before 7.2.2 contains an access-modifier bypass vulnerability in TypedObjectAccessor that allows template code to write CLR object properties without setter-visibility checks. Attackers can modify properties with private, internal, or init-only setters, and perform mass assignment on public-setter properties, permanently altering live host objects after template rendering.

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "9.8",
  "pubDate": "2026-08-16T14:16:55.770Z",
  "pubdate": "2026-08-16T14:16:55.770Z",
  "executiveSummary": "Scriban before version 7.2.2 contains an access-modifier bypass vulnerability within the TypedObjectAccessor component, categorized as an improper access control flaw.\nThe vulnerability allows untrusted template code to write to Common Language Runtime (CLR) object properties without enforcing standard setter-visibility checks.\nAttackers can successfully modify object properties equipped with private, internal, or init-only setters, and execute mass assignment attacks against public-setter properties.\nThe impact of this security flaw includes the permanent alteration of live host objects residing in memory after the template rendering process completes.\nAffected systems involve applications utilizing Scriban versions prior to 7.2.2 to render templates against arbitrary CLR objects.\nRisk implications are high, as state manipulation of host objects can lead to logic bypasses, privilege escalation, or data corruption depending on the application context and the specific properties exposed to the template engine.\nAttacker capabilities require the ability to supply or modify template code executed by the Scriban engine, leveraging the object accessor mechanics to target internal data structures.",
  "technicalDetails": "The vulnerability resides in the TypedObjectAccessor component of the Scriban template engine, which is responsible for mediating interactions between template scripts and .NET CLR objects.\nThe root cause of the flaw is the insufficient enforcement of language-level and runtime access modifiers during property assignment operations within the object accessor logic.\nNormally, .NET reflection or accessor mechanisms restrict writes to properties lacking public, accessible setters—such as those marked with private, internal, or init-only accessors.\nTypedObjectAccessor fails to validate these visibility constraints properly, enabling template expressions to invoke setter logic on restricted properties.\nDuring the attack flow, an adversary crafts a malicious template containing assignment statements targeting properties of bound CLR objects that are intended to be read-only or hidden from external modification.\nWhen the Scriban engine evaluates the template, the TypedObjectAccessor resolves the target property and bypasses visibility checks, directly mutating the underlying memory state of the live host object.\nAdditionally, this mechanism facilitates mass assignment vulnerabilities, where an attacker can overwrite multiple public-setter properties simultaneously in an unintended manner.\nThe affected versions are strictly Scriban before 7.2.2.\nNo specific authentication or privilege requirements beyond the capability to supply or influence template input are inherently required by the vulnerability itself, making it dependent on the application's template execution trust boundary.\nThe post-exploitation impact includes persistent state corruption of host application objects, potentially destabilizing the runtime environment or altering application business logic based on corrupted object properties."
}