CyberRota Analysis
AI-GeneratedScriban versions prior to 7.0.0 are vulnerable due to improper caching of TypedObjectAccessor, which fails to account for changes in MemberFilter settings. This flaw allows attackers to access sensitive properties and fields by reusing a TemplateContext, effectively bypassing sandbox restrictions and potentially compromising data across different requests or tenants. Organizations utilizing Scriban for templating should prioritize patching this vulnerability to mitigate the risk of unauthorized data exposure.
Public Exploit Signal
A public exploit, PoC, GitHub repository or Metasploit reference was detected for this CVE.
Note: these links are listed for security research and verification purposes only.
Original NVD Description
Scriban before 7.0.0 caches TypedObjectAccessor by Type only without considering MemberFilter changes, allowing reused TemplateContext instances to expose members that should be hidden. Attackers can access filtered properties and fields by reusing a TemplateContext after tightening its MemberFilter, bypassing sandbox policies across requests or tenants.