CyberRota Analysis
AI-GeneratedScriban versions prior to 7.0.0 are vulnerable due to a failure to clear the CachedTemplates dictionary upon calling TemplateContext.Reset(), which allows cached templates to persist across different contexts. This can enable attackers to exploit request-dependent ITemplateLoader implementations, potentially accessing sensitive content from previously authorized templates without revalidation. Organizations using Scriban for template rendering should prioritize patching to mitigate the risk of unauthorized data exposure.
Public Exploit Signal
A public exploit, PoC, GitHub repository or Metasploit reference was detected for this CVE.
Note: these links are listed for security research and verification purposes only.
Original NVD Description
Scriban before 7.0.0 fails to clear the CachedTemplates dictionary when TemplateContext.Reset() is called, allowing cached templates to persist across reused contexts. Attackers can exploit request-dependent ITemplateLoader implementations to access previously authorized template content from earlier renders without triggering TemplateLoader.Load() again.