A critical access-modifier bypass in the Scriban template engine allows unauthenticated remote attackers to modify protected object properties, potentially leading to full system compromise.

The vulnerability exists in the TypedObjectAccessor component, where template code can write to CLR object properties without proper setter-visibility checks. This allows an unauthenticated attacker to manipulate private, internal, or init-only setters, effectively performing mass assignment on sensitive host objects.

Successful exploitation allows an attacker to permanently alter the state of live host objects after template rendering. Given the CVSS score of 9.8, this vulnerability poses a severe risk to data integrity and system security, potentially enabling arbitrary code execution or privilege escalation within the application environment.

Immediate Action: Update the scriban package to version 7.2.2 or later via your package manager (e.g., NuGet).

Proactive Monitoring: Review application logs for unusual template rendering behavior or unexpected modifications to internal object states.

Compensating Controls: Implement strict input validation for templates and, where possible, utilize sandboxing configurations that restrict the scope of accessible object properties.

Public Exploit Available: No

This is a critical vulnerability that requires immediate attention. Organizations utilizing the Scriban template engine should prioritize upgrading to version 7.2.2 to close this access-modifier bypass. Failure to patch may allow remote attackers to gain unauthorized control over application logic and object data.