PT-2026-60658 · Nuget · Scriban

Published

2026-07-06

·

Updated

2026-07-06

CVSS v4.0

7.7

High

VectorAV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:H/VA:N/SC:N/SI:N/SA:N/E:P

Description

When a host pushes a CLR object into a Scriban TemplateContext via the standard, documented pattern —
csharp
var so = new ScriptObject();
so["user"] = currentUser;  // direct CLR reference
context.PushGlobal(so);
— TypedObjectAccessor exposes every public-getter property for both reading and writing, and writes land on the live host object and persist after Render() returns. The write path performs no CanWrite and no setter-visibility check, producing two related but distinct weaknesses:
(A) Mass assignment of public setters — CWE-915 (originally F-002). Any { get; set; } property is writable from template code ({{ user.is admin = true }}, {{ order.total price = 0 }}). This is "surprising but technically consistent with the setter being public" — and crucially, Scriban offers no way to expose such a property read-only, because MemberFilter is read/write-symmetric.
(B) Access-modifier bypass — CWE-284 (originally F-007). Properties the developer deliberately restricted are also writable, because reflection ignores C# accessibility:
DeclarationDeveloper intentActual behavior
{ get; set; }writablewritable (mass assignment — A)
{ get; private set; }only the owning class writestemplate writes freely
{ get; internal set; }only the declaring assembly writestemplate writes freely
{ get; init; }immutable after construction (C# 9 language guarantee)template writes freely post-construction
The init-only post-construction write — the highest false-positive risk — was explicitly confirmed against the shipped 7.2.1 package.

Affected Versions

All releases that ship TypedObjectAccessor (<= 7.2.1). PrepareMembers has used the getter-only filter since the accessor was introduced, and TrySetValue has never checked the setter. The init bypass applies on .NET 5+; private set / internal set apply on every supported runtime. No patched version exists.

Steps to Reproduce

Copy-paste. Run from the engagement root (the folder containing both scriban/ and reports/).
Prereqs:
bash
test -d scriban || { echo "scriban source missing"; exit 1; }
( command -v dotnet >/dev/null && dotnet --list-sdks | grep -q '^10.' ) 
 || ( "$HOME/.dotnet/dotnet" --list-sdks | grep -q '^10.' ) 
 || { echo ".NET 10 SDK missing"; exit 1; }
export PATH="$HOME/.dotnet:$PATH"
Run both PoCs (native):
bash
( cd reports/f002/poc && dotnet run -c Release )  # (A) public-setter mass assignment
( cd reports/f007/poc && dotnet run -c Release )  # (B) private/internal/init bypass
Docker fallback (no native SDK required):
bash
docker run --rm -v "$PWD":/work -w /work/reports/f007/poc 
 mcr.microsoft.com/dotnet/sdk:10.0 bash -lc "dotnet run -c Release"
Confirm the published package is affected (not just master): swap the ProjectReference in reports/f007/poc/poc.csproj for <PackageReference Include="Scriban" Version="7.2.1" /> and re-run — the four bypasses still succeed.
Each PoC prints [1] original CLR values, [2] template output (reads originals → writes → reads back), and [3] the C#-side read after Render() proving the live host object was permanently altered.

Remediation

Fixes are listed flat. Note that (B) has a clean, clearly-correct code fix; (A) requires a new control because public-setter writes are otherwise by-design.
  • Fix 1 — block restricted setters in TrySetValue (TypedObjectAccessor.cs L108–L123). Fixes (B). Before the L120 SetValue, require a public, non-init setter:
    csharp
    var setM = propertyAccessor.GetSetMethod(nonPublic: false);
if (setM is null) return false;  // private / internal / protected setters
if (setM.ReturnParameter.GetRequiredCustomModifiers()
   .Any(m => m.FullName == "System.Runtime.CompilerServices.IsExternalInit"))
  return false;         // init-only: setter IS public, so the IsExternalInit check is REQUIRED
    A plain GetSetMethod(nonPublic:false) != null check is not sufficient for init — the init setter is public; only the IsExternalInit modreq distinguishes it.
  • Fix 2 — give hosts a read/write distinction (addresses (A)). Add a MemberWriteFilter on TemplateContext (separate from MemberFilter) and/or a [ScriptMemberReadOnly] attribute, and split members into readableMembers / writableMembers in PrepareMembers (L126–L186). Public-settable mass assignment cannot be blocked without one of these, because MemberFilter is read/write-symmetric today.
  • Fix 3 — restore read-only-by-default on ScriptObject.Import (ScriptObjectExtensions.cs L320–L324). Gate the Liquid-compatibility relaxation behind an explicit opt-in instead of removing write protection globally.
  • Fix 4 — documentation (site/docs/runtime/safe-runtime.md). State explicitly that templates can write CLR properties via reflection (including private/internal/init setters), and that MemberFilter does not separate read from write.
  • Fix 5 — regression tests (src/Scriban.Tests/). Assert private set / internal set / init are non-writable from templates, that MemberWriteFilter / [ScriptMemberReadOnly] gate writes, and that only public set is writable.

References

Fix

Improper Access Control

Found an issue in the description? Have something to add? Feel free to write us 👾
dbugs@ptsecurity.com

Weakness Enumeration

CWE-915CWE-284

Related Identifiers

GHSA-7JVP-HJ45-2F2M

Affected Products

Scriban