CVE-2026-73061

Name of the Vulnerable Software and Affected Versions Scriban versions prior to 7.2.2

Description An access-modifier bypass exists in the TypedObjectAccessor component. This issue allows template code to write Common Language Runtime (CLR) object properties by bypassing setter-visibility checks. Consequently, an attacker can modify properties that have private, internal, or init-only setters and perform mass assignment on properties with public setters, leading to the permanent alteration of live host objects after the template is rendered.

Recommendations Update to version 7.2.2 or later.