Act nowDisclosed

Advisory · CVE-2026-124438

Scriban templates can peek inside .NET internals and steal captured secrets

Scriban before 7.5.2 contains an information disclosure and object manipulation flaw that lets template authors access .NET internals of function values through reflection member accessors, using array.map to read Target, Method, or ReturnType on imported delegates and overwrite service properties and captured closure secrets, rated critical at CVSS 9.1 under version 4.0; fixed in 7.5.2.

Advisory published November 8, 2026Independent summary
Vendor
Scriban
Product
Scriban
Identifier / CWE
CVE-2026-124438
CWE-200
Action timing
Immediate
ELI5

Explain it like I’m five

Scriban templates are supposed to see only what the host hands them. A flaw lets a template reach behind the curtain with array.map and read the hidden guts of functions, including secrets a function captured when it was created, and even rewrite service settings.

SIMPLIFIED_ATTACK_PATH04 STEPS
  1. 01Template supplied

    An untrusted author supplies a template to a Scriban host.

  2. 02Delegate reached

    The template accesses an imported delegate through array.map member access.

  3. 03Internals exposed

    Target, Method, and ReturnType of the delegate are read through reflection accessors.

  4. 04Secrets read

    Captured closure secrets, service properties, and assembly paths are exposed or overwritten.

What happened

Scriban before 7.5.2 contains an information disclosure and object manipulation vulnerability that allows template authors to access .NET internals of function values through reflection member accessors. Attackers can use array.map to read Target, Method, or ReturnType on imported delegates, exposing and overwriting service properties, captured closure secrets, and assembly paths. The record rates it critical at CVSS 9.1 under version 4.0, with network attack vector, high complexity, no privileges required, and no user interaction.

A template that can read closure secrets is not sandboxed in any meaningful sense, and the same path allows overwriting service state. The flaw is fixed in Scriban 7.5.2.

What to do

  1. Inventory applications using Scriban, including Scriban.Signed, and record each version.
  2. Upgrade to Scriban 7.5.2 or later.
  3. Review template rendering logs for array.map member access patterns.
  4. Treat any secret reachable from a rendered template as potentially exposed and rotate it.
  5. Verify the deployed version after updating.

Management note

Template sandbox escapes that expose secrets need credential rotation, not just a version bump. Assume anything a template could reach was reached.