It affects how function values expose .NET internals to templates through reflection-based member access.A template author may reach objects behind imported delegates. The advisory says exposed data can include service properties, captured closure values, assembly paths, and runtime versions.
What it allows
The flaw crosses Scriban's documented exposure boundary. A function wrapper can receive a reflection accessor, making its public members available to template operations that inspect raw items.
When a host imports an instance-method delegate or a lambda that captures local state, the template may reach the delegate target. Public properties and fields on reachable objects can then be read or changed.
The advisory says changes can persist after rendering. Shared service objects may carry those changes across later renders, users, or tenants.
Who is affected
Scriban and Scriban.Signed versions through 7.5.1 are affected. Version 7.5.2 is the patched release for both NuGet packages.
The highest-impact path requires a host to import an instance-method delegate or a capturing lambda. Even without that host condition, templates may expose reflection objects and disclose deployment details.
What to do
-
Upgrade Scriban packages to 7.5.2 or later
Update both Scriban and Scriban.Signed wherever they are present. Confirm the deployed package version after rebuilding and releasing affected applications.
-
Prioritize systems that process untrusted templates
Identify services where external users can submit or influence templates. Prioritize hosts that import instance-method delegates or lambdas capturing services, credentials, configuration, or authorization state.
-
Review exposed delegate state and application logs
Brandefense recommends checking delegate target objects for unexpected property changes. Review template-rendering logs for unusual member traversal, repeated rendering failures, or access to reflection metadata.
What Brandefense can do
- Scan your domain in Brandefense Atlas, free
Atlas checks public sources for leaked credentials, phishing domains, dark web mentions and data sales, then gives your domain a risk grade. Free, no sign-up.
- Vulnerability Intelligence
Brandefense Vulnerability Intelligence follows which vulnerabilities attackers are using, so your team can patch what is under attack first.
Frequently Asked Questions
What is CVE-2026-124438?
It is a Scriban flaw that lets template authors reach .NET internals exposed by function values. The impact includes information disclosure and object state modification.
Which Scriban versions are affected?
Scriban and Scriban.Signed versions through 7.5.1 are affected. The GitHub advisory identifies 7.5.2 as the patched version.
When does CVE-2026-124438 have the highest impact?
The highest-impact path exists when a host imports instance-method delegates or lambdas that capture local state. Reachable public data may be read or changed.
