Advisory Database
  • Advisories
  • Dependency Scanning
  1. nuget
  2. ›
  3. scriban
  4. ›
  5. GHSA-5wr9-m6jw-xx44

GHSA-5wr9-m6jw-xx44: Scriban: Sandbox escape due to TypedObjectAccessorcache bypassing MemberFilter after TemplateContext reuse

March 24, 2026

TemplateContext caches type accessors by Type only, but those accessors are built using the current MemberFilter and MemberRenamer. When a TemplateContext is reused and the filter is tightened for a later render, Scriban still reuses the old accessor and continues exposing members that should now be hidden.

References

  • github.com/advisories/GHSA-5wr9-m6jw-xx44
  • github.com/scriban/scriban
  • github.com/scriban/scriban/security/advisories/GHSA-5wr9-m6jw-xx44

Code Behaviors & Features

Detect and mitigate GHSA-5wr9-m6jw-xx44 with GitLab Dependency Scanning

Secure your software supply chain by verifying that all open source dependencies used in your projects contain no disclosed vulnerabilities. Learn more about Dependency Scanning →

Affected versions

All versions before 7.0.0

Fixed versions

  • 7.0.0

Solution

Upgrade to version 7.0.0 or above.

Impact 9.1 CRITICAL

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N

Learn more about CVSS

Weakness

  • CWE-693: Protection Mechanism Failure

Source file

nuget/scriban/GHSA-5wr9-m6jw-xx44.yml

Spotted a mistake? Edit the file on GitLab.

  • Site Repo
  • About GitLab
  • Terms
  • Privacy Statement
  • Contact

Page generated Wed, 25 Mar 2026 12:18:27 +0000.