CVE-2026-74791

9.2 criticalEPSS 0.4%

Critical (9.2). EPSS 0.4% chance of exploitation in the next 30 days.

Scriban before 7.0.0 fails to clear the CachedTemplates dictionary when TemplateContext.Reset() is called, allowing cached templates to persist across reused contexts. Attackers can exploit request-dependent ITemplateLoader implementations to access previously authorized template content from earlier renders without triggering TemplateLoader.Load() again.

Severity

CVSS 4.0

9.2 critical

CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:N/VA:N/SC:H/SI:N/SA:N

CVSS 3.1

8.6 high

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:N/A:N

EPSS: 0.4% chance of exploitation in the next 30 days; higher than 37% of CVEs (scores of 2026-10-31)
CWE: CWE-226
Published: 2026-08-16
Modified: 2026-08-31
Record from: the NVD, synced 2026-10-19

References

https://github.com/scriban/scriban/security/advisories/GHSA-x6m9-38vm-2xhf
https://www.vulncheck.com/advisories/scriban-before-authorization-bypass-via-stale-include-cache
https://github.com/scriban/scriban/security/advisories/GHSA-x6m9-38vm-2xhf

Check your stack JSON