Critical severity9.1NVD Advisory· Published Aug 16, 2026· Updated Aug 31, 2026

CVE-2026-74790

Description

Scriban before 7.0.0 caches TypedObjectAccessor by Type only without considering MemberFilter changes, allowing reused TemplateContext instances to expose members that should be hidden. Attackers can access filtered properties and fields by reusing a TemplateContext after tightening its MemberFilter, bypassing sandbox policies across requests or tenants.

AI Insight

LLM-synthesized narrative grounded in this CVE's description and references.

Affected products

Scriban/scribanllm-fuzzy
Range: <7.0.0

Patches

Vulnerability mechanics

References

github.com/scriban/scriban/security/advisories/GHSA-5wr9-m6jw-xx44nvd
www.vulncheck.com/advisories/scriban-before-memberfilter-bypass-via-templatecontext-cachenvd

News mentions

Scriban: Fifteen Recursion, DoS, and Access Control Flaws Disclosed Together
Vypr Intelligence · Aug 16, 2026

cvss	0.591
epss	0.000
exploit	0.000
kev	0.000
patch	-0.070
ransomware	0.000