Description
Scriban before 7.0.0 fails to clear the CachedTemplates dictionary when TemplateContext.Reset() is called, allowing cached templates to persist across reused contexts. Attackers can exploit request-dependent ITemplateLoader implementations to access previously authorized template content from earlier renders without triggering TemplateLoader.Load() again.
Affected products
| Vendor | Product | Affected | Fixed |
|---|---|---|---|
| scriban | scriban | < 7.0.0 | 7.0.0 |
Affected packages
| Ecosystem | Package | Affected | Fixed | Record |
|---|---|---|---|---|
| NuGet | scriban | < 7.0.0 | 7.0.0 | GHSA-x6m9-38vm-2xhf |
| NuGet | Scriban.Signed | < 7.0.0 | 7.0.0 | GHSA-x6m9-38vm-2xhf |
References
- GitHub Security Advisory (GHSA-x6m9-38vm-2xhf) vendor-advisory
- VulnCheck Advisory: Scriban before 7.0.0 Authorization Bypass via Stale Include Cache third-party-advisory