CVE-2026-74790 Scriban before 7.0.0 MemberFilter Bypass via TemplateContext Cache
Attackers can bypass sandbox restrictions in Scriban by reusing cached template contexts, exposing hidden properties and fields across requests.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- None listed
What is CVE-2026-74790?
CVE-2026-74790 is a critical vulnerability in scriban, published on 16 Aug 2026. An attacker can exploit it over the internet without logging in, with no action from the victim.
Official description
Scriban before 7.0.0 caches TypedObjectAccessor by Type only without considering MemberFilter changes, allowing reused TemplateContext instances to expose members that should be hidden. Attackers can access filtered properties and fields by reusing a TemplateContext after tightening its MemberFilter, bypassing sandbox policies across requests or tenants.
Weakness: CWE-693
Which versions are affected by CVE-2026-74790?
4 open source packages ship an affected version, including Scriban.Signed and scriban.
| Package | Affected | Fixed in |
|---|---|---|
Scriban.Signed NuGet | All versions | 7.0.0 |
Scriban.Signed NuGet | All versions | 7.0.0 |
scriban NuGet | All versions | 7.0.0 |
scriban NuGet | All versions | 7.0.0 |
How do I fix CVE-2026-74790?
Upgrade Scriban.Signed to 7.0.0 or later.
Is CVE-2026-74790 being exploited?
It is not confirmed as exploited in the wild, but public exploit code for CVE-2026-74790 exists.
Sources
Also known as GHSA-5wr9-m6jw-xx44, GHSA-6w6f-93jg-2qf5.