CVE-2026-74790

Scriban before 7.0.0 caches TypedObjectAccessor by Type without considering MemberFilter changes, enabling reuse of a TemplateContext to expose members that should be hidden. Affected software: Scriban prior to 7.0.0. Root cause: TemplateContext cache ignores updates to MemberFilter, causing prev...

CVE-2026-74790 Scriban before 7.0.0 MemberFilter Bypass via TemplateContext Cache

Scriban before 7.0.0 caches TypedObjectAccessor by Type only without considering MemberFilter changes, allowing reused TemplateContext instances to expose members that should be hidden. Attackers can access filtered properties and fields by reusing a TemplateContext after tightening its...