Description
Scriban before 7.2.2 contains an access-modifier bypass vulnerability in TypedObjectAccessor that allows template code to write CLR object properties without setter-visibility checks. Attackers can modify properties with private, internal, or init-only setters, and perform mass assignment on public-setter properties, permanently altering live host objects after template rendering.
Affected products
| Vendor | Product | Affected | Fixed |
|---|---|---|---|
| scriban | scriban | < 7.2.2 | 7.2.2 |
Affected packages
| Ecosystem | Package | Affected | Fixed | Record |
|---|---|---|---|---|
| NuGet | Scriban | < 7.2.2 | 7.2.2 | GHSA-7jvp-hj45-2f2m |
References
- GitHub Security Advisory (GHSA-7jvp-hj45-2f2m) vendor-advisory
- VulnCheck Advisory: Scriban before 7.2.2 Arbitrary Property Write via TypedObjectAccessor third-party-advisory