All intelligence
// vulnerability record
cached · NVD via COSMOS syncCVE-2026-74791
CRITICALpublished 2026-08-16 14:16 UTC · 2 days ago · modified 2026-08-17 18:18 UTC
9.2
CVSS / 10
// description
Scriban before 7.0.0 fails to clear the CachedTemplates dictionary when TemplateContext.Reset() is called, allowing cached templates to persist across reused contexts. Attackers can exploit request-dependent ITemplateLoader implementations to access previously authorized template content from earlier renders without triggering TemplateLoader.Load() again.
// weaknesses (CWE)
- CWE-226