CVE-2026-74791 in Scriban
Summary
by MITRE • 08/16/2026
Scriban before 7.0.0 fails to clear the CachedTemplates dictionary when TemplateContext.Reset() is called, allowing cached templates to persist across reused contexts. Attackers can exploit request-dependent ITemplateLoader implementations to access previously authorized template content from earlier renders without triggering TemplateLoader.Load() again.
If you want to get the best quality for vulnerability data then you always have to consider VulDB.
Analysis
by VulDB Data Team • 08/16/2026
The vulnerability in Scriban versions prior to 7.0.0 represents a significant flaw in the lifecycle management of cached templates within the templating engine's execution context. Specifically, when an application utilizes request-dependent ITemplateLoader implementations and invokes the Reset method on the TemplateContext object, the internal CachedTemplates dictionary is not properly cleared. This failure to reset state means that templates loaded during previous rendering operations remain resident in memory and accessible for subsequent uses of the same context instance. In typical web applications or services where template contexts are pooled or reused to improve performance by avoiding the overhead of creating new objects for every request, this behavior creates a dangerous persistence mechanism for sensitive data embedded within those cached templates.
From an operational perspective, this flaw allows attackers who can influence the initial rendering process to inject malicious content into the cache through legitimate authorization channels. Because subsequent requests reusing the same TemplateContext instance will retrieve these previously loaded templates without invoking the ITemplateLoader.Load method again, the application effectively bypasses any access control checks or validation logic that would normally occur during a fresh load operation. This results in an unauthorized information disclosure scenario where users can view template content intended for other contexts or earlier sessions, potentially exposing internal business logic, configuration details, or user-specific data that was rendered into those templates previously.
This vulnerability aligns with CWE-200, which covers Information Exposure, as well as CWE-16, known as Configuration Error, due to the improper handling of state reset operations in a security-critical component. In terms of the MITRE ATT&CK framework, this behavior facilitates Initial Access and Collection phases by allowing an attacker to leverage existing authenticated sessions or contexts to extract data that should be isolated per request. The lack of proper cache invalidation effectively turns the performance optimization feature into a side-channel for data leakage across logical boundaries within the application.
To mitigate this vulnerability, developers must upgrade to Scriban version 7.0.0 or later where the issue has been addressed by ensuring that TemplateContext.Reset() correctly clears the CachedTemplates dictionary. For applications unable to immediately update their dependencies, implementing custom wrapper logic around the TemplateContext usage is necessary. This involves explicitly clearing any cached templates before reusing a context instance or avoiding context pooling altogether if strict isolation between requests is required. Additionally, auditing ITemplateLoader implementations for side effects and ensuring that no sensitive data is rendered into templates unless absolutely necessary can reduce the blast radius of such state persistence issues in legacy systems.