Vulnerabilities & PatchesEmerging1 src
CVE-2026-74790 - Scriban before 7.0.0 MemberFilter Bypass via TemplateContext Cache
CVE ID : CVE-2026-74790
Published : Aug. 16, 2026, 2:16 p. m.
• 50 minutes ago
Description : Scriban before 7. 0. 0 caches TypedObjectAccessor by Type only without considering MemberFilter changes, allowing reused TemplateContext instances to expose members that should be hidden. Attackers can access filtered properties and fields by reusing a TemplateContext after tightening its MemberFilter, bypassing sandbox policies across requests or tenants.
Severity: 9.3
• CRITICAL
Visit the link for more details, such as CVSS details, affected products, timeline, and more...