CVE-2026-74791
HIGH
NVD
CVSS Score
8.6
Severity
HIGH
Published
Aug 16, 2026
Vendor
unknown
Description
Scriban before 7.0.0 fails to clear the CachedTemplates dictionary when TemplateContext.Reset() is called, allowing cached templates to persist across reused contexts. Attackers can exploit request-dependent ITemplateLoader implementations to access previously authorized template content from earlier renders without triggering TemplateLoader.Load() again.