CVE-2026-73061 Scriban before 7.2.2 Arbitrary Property Write via TypedObjectAccessor
Attackers can bypass access modifiers to modify private or internal properties of host objects via Scriban templates, potentially leading to data modification or code execution.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- None listed
What is CVE-2026-73061?
CVE-2026-73061 is a critical missing authorization vulnerability in scriban, published on 16 Aug 2026. An attacker can exploit it over the internet without logging in, with no action from the victim.
Official description
Scriban before 7.2.2 contains an access-modifier bypass vulnerability in TypedObjectAccessor that allows template code to write CLR object properties without setter-visibility checks. Attackers can modify properties with private, internal, or init-only setters, and perform mass assignment on public-setter properties, permanently altering live host objects after template rendering.
Weakness: CWE-284
Which versions are affected by CVE-2026-73061?
2 open source packages ship an affected version, including Scriban.
| Package | Affected | Fixed in |
|---|---|---|
Scriban NuGet | All versions | 7.2.2 |
Scriban NuGet | All versions | 7.2.2 |
How do I fix CVE-2026-73061?
Upgrade Scriban to 7.2.2 or later.
Upgrade, and check permissions on every request on the server, not only in the interface. More about Missing authorization.
Is CVE-2026-73061 being exploited?
It is not confirmed as exploited in the wild, but public exploit code for CVE-2026-73061 exists.
Sources
Also known as GHSA-4279-f6cf-4g7r, GHSA-7jvp-hj45-2f2m.