CVE-2026-74790CWE-693

CVE-2026-74790

Critical · published August 16, 2026

CVSS v3.1
9.1
EPSS
0%
Percentile
39.8
In the wild
Unconfirmed
What it is

Scriban before 7.0.0 caches TypedObjectAccessor by Type only without considering MemberFilter changes, allowing reused TemplateContext instances to expose members that should be hidden. Attackers can access filtered properties and fields by reusing a TemplateContext after tightening its MemberFilter, bypassing sandbox policies across requests or tenants.

The record
Technical detail
CVSS v3.1
9.1 · CRITICAL
Vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N
CVSS v4.0
9.3 · CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N
EPSS
0.00471 · 39.8th percentile
Weakness
CWE-693 · Protection Mechanism Failure
Published
2026-08-16T18:16Z
References (3)
https://github.com/scriban/scriban/security/advisories/GHSA-5wr9-m6jw-xx44 · [email protected]https://www.vulncheck.com/advisories/scriban-before-memberfilter-bypass-via-templatecontext-cache · [email protected]https://github.com/scriban/scriban/security/advisories/GHSA-5wr9-m6jw-xx44 · 134c704f-9b21-4f2e-91b3-4a467353bcc0
EPSS history
Timeline
  • 16 AUG 13:14Z
    Scriban before 7.0.0 MemberFilter Bypass via TemplateContext Cache
    cvelistv5