CVE-2026-74791 Scriban before 7.0.0 Authorization Bypass via Stale Include Cache
Attackers can access previously authorized template content from earlier renders due to stale cache persistence in reused contexts.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- None listed
What is CVE-2026-74791?
CVE-2026-74791 is a critical vulnerability in scriban, published on 16 Aug 2026. An attacker can exploit it over the internet without logging in, with no action from the victim.
Official description
Scriban before 7.0.0 fails to clear the CachedTemplates dictionary when TemplateContext.Reset() is called, allowing cached templates to persist across reused contexts. Attackers can exploit request-dependent ITemplateLoader implementations to access previously authorized template content from earlier renders without triggering TemplateLoader.Load() again.
Weakness: CWE-226
Which versions are affected by CVE-2026-74791?
4 open source packages ship an affected version, including Scriban.Signed and scriban.
| Package | Affected | Fixed in |
|---|---|---|
Scriban.Signed NuGet | All versions | 7.0.0 |
Scriban.Signed NuGet | All versions | 7.0.0 |
scriban NuGet | All versions | 7.0.0 |
scriban NuGet | All versions | 7.0.0 |
How do I fix CVE-2026-74791?
Upgrade Scriban.Signed to 7.0.0 or later.
Is CVE-2026-74791 being exploited?
It is not confirmed as exploited in the wild, but public exploit code for CVE-2026-74791 exists.
Sources
Also known as GHSA-58jr-9c6g-55jq, GHSA-x6m9-38vm-2xhf.