Dashboard / CVE-2026-124438

CVE-2026-124438

CRITICAL
INFO Priority: 0.03 BB Relevance: 68/100
Published: 2026-11-08 Modified: 2026-11-12 First seen: 2026-11-08 Status: active

Attack Surface

Network No Auth No Interaction Conf. Impact Integ. Impact

CVSS Vector Breakdown

AV: Network
AC: High
PR: None
UI: None
S: X
AT: Present
VC: High
VI: High
VA: None

Description

Scriban before 7.5.2 contains an information disclosure and object manipulation vulnerability that allows template authors to access .NET internals of function values through reflection member accessors. Attackers can use array.map to read Target, Method, or ReturnType on imported delegates, exposing and overwriting service properties, captured closure secrets, and assembly paths.

Weakness Classification (1)

Affected Software (4)

VendorProductVersion
scriban scriban 0 < 7.5.2
scriban scriban 0 < 7.5.2
scriban scriban 0 < 7.5.2
scriban scriban 0 < 7.5.2

References & Advisories (2)

Bug Bounty Relevance

68 / 100
✓ Network accessible
✓ No authentication
✓ No user interaction

CVSS Score

9.1 / 10.0 v4.0
CVSS:4.0/AV:N/AC:H/AT:P/PR:N/UI:N/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

EPSS — Exploitation Probability

0.36%
Raw Score 0.003640
Percentile 30.7%
Date 2026-11-13

EPSS Trend

2026-11-13
0.00364
2026-11-12
0.00364
2026-11-10
0.00364
2026-11-09
0.00364

Intelligence Sources

mitre ref →
nvd ref →

External Links