GHSA-7jvp-hj45-2f2m: Scriban: Template Writes to Arbitrary CLR Properties via `TypedObjectAccessor` (Mass Assignment + `private` / `init` / `internal` Setter Bypass)
Scriban versions up to 7.2.1 contain a vulnerability in TypedObjectAccessor where template code can write to arbitrary CLR object properties, including those with private, internal, or init-only setters. This occurs because the write path does not check setter visibility, allowing mass assignment and access modifier bypass. No patched version currently exists.
AI Analysis
Technical Summary
When a CLR object is pushed into a Scriban TemplateContext, TypedObjectAccessor exposes all public-getter properties for reading and writing without validating setter accessibility. This leads to two related issues: (A) mass assignment of any property with a public setter, allowing template code to modify such properties; and (B) bypass of access modifiers for private, internal, and init-only setters, permitting template code to write to properties that developers intended to restrict. The vulnerability affects all versions shipping TypedObjectAccessor (<=7.2.1). There is no official patch yet, but a proposed fix involves blocking restricted setters in the TrySetValue method by requiring a public, non-init setter.
Potential Impact
An attacker able to influence Scriban template code can modify live CLR objects' properties, including those intended to be immutable or restricted, potentially leading to unauthorized state changes or privilege escalation within the host application. These changes persist after template rendering completes, affecting application behavior or data integrity.
Mitigation Recommendations
No official patch or fix is currently available. Users should monitor vendor advisories for updates. The vulnerability requires code changes in TypedObjectAccessor to block writes to non-public and init-only setters. Until a fix is released, avoid pushing untrusted CLR objects into Scriban TemplateContext or restrict template code execution privileges.
GHSA-7jvp-hj45-2f2m: Scriban: Template Writes to Arbitrary CLR Properties via `TypedObjectAccessor` (Mass Assignment + `private` / `init` / `internal` Setter Bypass)
Description
Scriban versions up to 7.2.1 contain a vulnerability in TypedObjectAccessor where template code can write to arbitrary CLR object properties, including those with private, internal, or init-only setters. This occurs because the write path does not check setter visibility, allowing mass assignment and access modifier bypass. No patched version currently exists.
CVSS v4.0
Affected software
Run on your own infrastructure? Check whether these packages are installed with threat-finder — our free open-source scanner.
AI-Powered Analysis
Machine-generated threat intelligence
Technical Analysis
When a CLR object is pushed into a Scriban TemplateContext, TypedObjectAccessor exposes all public-getter properties for reading and writing without validating setter accessibility. This leads to two related issues: (A) mass assignment of any property with a public setter, allowing template code to modify such properties; and (B) bypass of access modifiers for private, internal, and init-only setters, permitting template code to write to properties that developers intended to restrict. The vulnerability affects all versions shipping TypedObjectAccessor (<=7.2.1). There is no official patch yet, but a proposed fix involves blocking restricted setters in the TrySetValue method by requiring a public, non-init setter.
Potential Impact
An attacker able to influence Scriban template code can modify live CLR objects' properties, including those intended to be immutable or restricted, potentially leading to unauthorized state changes or privilege escalation within the host application. These changes persist after template rendering completes, affecting application behavior or data integrity.
Mitigation Recommendations
No official patch or fix is currently available. Users should monitor vendor advisories for updates. The vulnerability requires code changes in TypedObjectAccessor to block writes to non-public and init-only setters. Until a fix is released, avoid pushing untrusted CLR objects into Scriban TemplateContext or restrict template code execution privileges.
Technical Details
- Gcve Source
- db.gcve.eu
- Osv Id
- GHSA-7jvp-hj45-2f2m
- Osv Schema Version
- 1.4.0
- Aliases
- []
- Ecosystems
- ["NuGet"]
- Database Specific Severity
- HIGH
- Cvss Version
- 4.0
Threat ID: 6a4c345427e9c797195fe153
Added to database: 07/06/2026, 23:03:48 UTC
Last enriched: 07/06/2026, 23:36:26 UTC
Last updated: 07/06/2026, 23:36:26 UTC
Views: 2
Community Reviews
0 reviewsCrowdsource mitigation strategies, share intel context, and vote on the most helpful responses. Sign in to add your voice and help keep defenders ahead.
Want to contribute mitigation steps or threat intel context? Sign in or create an account to join the community discussion.
Actions
Updates to AI analysis require Pro Console access. Upgrade inside Console → Billing.
External Links
Need more coverage?
Upgrade to Pro Console for AI refresh and higher limits.
For incident response and remediation, OffSeq services can help resolve threats faster.
Latest Threats
Check if your credentials are on the dark web
Instant breach scanning across billions of leaked records. Free tier available.