Scriban Template Engine Bypasses Property Access Controls

Scriban before version 7.2.2 contains a critical access-modifier bypass vulnerability in its TypedObjectAccessor component that allows template code to write to CLR object properties without respecting visibility constraints. This vulnerability enables attackers to modify properties marked as private, internal, or init-only—restrictions that exist specifically to prevent unauthorized state modification. Any application using Scriban to render untrusted templates, or where template authors have malicious intent, can be exploited to permanently alter live host objects. This is particularly dangerous in scenarios where Scriban is used for dynamic content generation, report rendering, or configuration management, as it breaks the fundamental security boundary between template execution sandboxes and protected application state.

Casky's Claude-powered analysis would identify this vulnerability pattern through detection of improper access control mechanisms (CWE-284). While no specific MITRE ATT&CK techniques are mapped to this CVE, practitioners using Casky would encounter findings related to **Execution** (T1203 - Exploitation for Client Execution) when analyzing template processing pipelines. The platform's 754 security skills would flag the absence of property-level access validation in reflection-based object manipulation, detecting when template engines fail to enforce CLR visibility modifiers. Practitioners would see alerts indicating unsafe property assignment patterns, unvalidated object mutation in rendering contexts, and the absence of execution sandboxing—allowing them to remediate by upgrading Scriban to 7.2.2+ or implementing strict input validation on all templates before processing.