CyberRota Analysis
AI-GeneratedScriban versions prior to 7.2.2 are vulnerable to an access-modifier bypass that permits unauthorized modification of CLR object properties, including those with restricted visibility. This critical vulnerability can lead to unauthorized changes in live host objects, potentially compromising application integrity and security. Organizations using Scriban should prioritize patching to mitigate the risk of exploitation.
Public Exploit Signal
A public exploit, PoC, GitHub repository or Metasploit reference was detected for this CVE.
Note: these links are listed for security research and verification purposes only.
Original NVD Description
Scriban before 7.2.2 contains an access-modifier bypass vulnerability in TypedObjectAccessor that allows template code to write CLR object properties without setter-visibility checks. Attackers can modify properties with private, internal, or init-only setters, and perform mass assignment on public-setter properties, permanently altering live host objects after template rendering.