Access-Modifier Bypass in Scriban by Scriban

CVE-2026-73061

What is CVE-2026-73061?

Scriban versions prior to 7.2.2 are susceptible to an access-modifier bypass vulnerability in TypedObjectAccessor. This flaw permits attackers to manipulate CLR object properties without adhering to setter-visibility constraints. Malicious entities can exploit this vulnerability to modify properties that are typically constrained by privacy levels, including private, internal, or init-only setters, as well as execute mass assignments on properties with public setters. This capability results in the unauthorized and permanent alteration of live host objects post-template rendering, posing significant risks to application integrity and security.

References