CVE-2026-73061 - Scriban before 7.2.2 Arbitrary Property Write via TypedObjectAccessor
Brief
CVE ID : CVE-2026-73061
Published : Aug. 16, 2026, 2:16 p. m.
- 6 hours, 50 minutes ago
Description : Scriban before 7.
- 2 contains an access-modifier bypass vulnerability in TypedObjectAccessor that allows template code to write CLR object properties without setter-visibility checks. Attackers can modify properties with private, internal, or init-only setters, and perform mass assignment on public-setter properties, permanently altering live host objects after template rendering.
Severity: 9.8
- CRITICAL
Visit the link for more details, such as CVSS details, affected products, timeline, and more...